9995a1c9ecf2a84bb9da752dfc43cbe8_sys

Type	Mode/Class	Details (Path/Message/Protocol/Hostname/Qtype/ListenPort etc.)	Process ID	Parent ID	File Size
Analysis
Malware


Application


3 Repeated items skipped
Config  Update


Uac
Service

Windows Image Acquisition (WIA)

Uac
Service

Multimedia Class Scheduler

Process
Started

C:\Users\Administrator\AppData\Local\Temp\factura.exe
  Parentname:  C:\Windows\explorer.exe
  Command Line:  "C:\Users\ADMINI~1\AppData\Local\Temp\factura.exe"
  MD5:  9995a1c9ecf2a84bb9da752dfc43cbe8
  SHA1: d54dcd18d30fc944347b994376282c9ec1b7467d
	604	1676	1206863
File
Failed

C:\Windows\System32\WOW64LOG.DLL
	604
Mutex

\Sessions\1\BaseNamedObjects\DBWinMutex
	604
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\KYEFJIANLV
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\kyEFJiaNlv
	604
File
Failed

C:\Windows\SysWOW64\KYEFJIANLV
	604
File
Failed

C:\Windows\system\KYEFJIANLV
	604
File
Failed

C:\Windows\KYEFJIANLV
	604
File
Failed

C:\Windows\SysWOW64\KYEFJIANLV
	604
File
Failed

C:\Windows\KYEFJIANLV
	604
File
Failed

C:\Windows\SysWOW64\wbem\KYEFJIANLV
	604
File
Failed

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\KYEFJIANLV
	604
File
Failed

C:\Program Files (x86)\Skype\Phone\KYEFJIANLV
	604
File
Failed

C:\Program Files (x86)\QuickTime\QTSystem\KYEFJIANLV
	604
File
Failed

C:\Program Files (x86)\Debugging Tools for Windows (x86)\KYEFJIANLV
	604
File
Failed

C:\Program Files\Debugging Tools for Windows (x64)\KYEFJIANLV
	604
API Call

  API Name:  GetDesktopWindow   Address:  0x004010e0
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  user32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\RXVWYJLHVY
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\rxVwYjlhVy
	604
File
Failed

C:\Windows\SysWOW64\RXVWYJLHVY
	604
File
Failed

C:\Windows\system\RXVWYJLHVY
	604
File
Failed

C:\Windows\RXVWYJLHVY
	604
File
Failed

C:\Windows\SysWOW64\RXVWYJLHVY
	604
File
Failed

C:\Windows\RXVWYJLHVY
	604
File
Failed

C:\Windows\SysWOW64\wbem\RXVWYJLHVY
	604
File
Failed

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\RXVWYJLHVY
	604
File
Failed

C:\Program Files (x86)\Skype\Phone\RXVWYJLHVY
	604
File
Failed

C:\Program Files (x86)\QuickTime\QTSystem\RXVWYJLHVY
	604
File
Failed

C:\Program Files (x86)\Debugging Tools for Windows (x86)\RXVWYJLHVY
	604
File
Failed

C:\Program Files\Debugging Tools for Windows (x64)\RXVWYJLHVY
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x75eef96e
  Params:  [0x75f56420, 260]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\NETAPI32.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\NETUTILS.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\SRVCLI.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\WKSCLI.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\SCHEDCLI.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\PROFAPI.DLL
	604
API Call

  API Name:  GetComputerNameW   Address:  0x00413a3c
  Params:  [0x18fb14, 0x18fb54]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413bac
  Params:  [0x18f94c, 260]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	604
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\
	604
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32
	604
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xi" = 7A2F0ADB1B90B147DABB
	604
File
Failed

C:\ProgramData\SYSTEM32\XVERSION
	604
File
Failed

C:\Users\Administrator\AppData\Roaming\SYSTEM32\XVERSION
	604
File
Failed

C:\ProgramData\WINDOWS
	604
Folder
Created

C:\ProgramData\Windows
	604
Folder
Hide

C:\ProgramData\Windows
	604
File
Failed

C:\ProgramData\Windows\CSRSS.EXE
	604
File
Created

C:\ProgramData\Windows\csrss.exe
	604
Malicious  Alert
Malicious  Directory

Message:   Executable file created in suspicious location

Malicious  Alert
Misc  Anom

Message:   Generic Trojan Behavior

API Call

  API Name:  SetProcessDEPPolicy   Address:  0x00470bd9
  Params:  [1]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Folder
Created

C:\Users\Administrator\AppData\Local\Temp\6893A5D897
	604
File
Close

C:\ProgramData\Windows\csrss.exe
  MD5:  9995a1c9ecf2a84bb9da752dfc43cbe8
  SHA1: d54dcd18d30fc944347b994376282c9ec1b7467d
	604	 	1206863
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Regkey
Setval

\REGISTRY\USER\S-1-5-21-2529703413-2662079939-3113469119-500\Software\Microsoft\Windows\CurrentVersi
   on\Run\"Client Server Runtime Subsystem" = "C:\ProgramData\Windows\csrss.exe"
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xVersion" = 4.0.0.1
	604
API Call

  API Name:  GetComputerNameExW   Address:  0x776ace4b
  Params:  [0, 0x77740a6c, 0x777401c0]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
3 Repeated items skipped
API Call

  API Name:  CryptAcquireContextW   Address:  0x004247f1
  Params:  [NULL, NULL, 1, 4026531840]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  advapi32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\CRYPTSP.DLL
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetDesktopWindow   Address:  0x0041e281
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  user32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Process32First   Address:  0x00424bf3
  Params:  [0x158, 0x265f7a0]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Malicious  Alert
Generic  Anomalous  Activity

Message:   Enumerating running processes

API Call

  API Name:  CryptAcquireContextA   Address:  0x0050087e
  Params:  [NULL, NULL, 1, 4026531840]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  advapi32.dll
	604
API Call

  API Name:  GetDesktopWindow   Address:  0x0041e281
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  user32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Process32First   Address:  0x00424bf3
  Params:  [0x14c, 0x265f718]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Windows\SysWOW64\RPCSS.DLL
	604
2 Repeated items skipped
API Call

  API Name:  GetVolumeNameForVolumeMountPointW   Address:  0x76a80aaa
  Params:  [NULL, \\?\Volume{a4dcb962-c2b8-11e2-8b83-806e6f6e6963}\]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetTokenInformation   Address:  0x76a80172
  Params:  [0x18c, 0x19]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  advapi32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\NTMARTA.DLL
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x75709cce
  Params:  [0x2d0f6cc, 260]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetVolumeNameForVolumeMountPointW   Address:  0x76a80e20
  Params:  [NULL, \\?\Volume{a4dcb965-c2b8-11e2-8b83-806e6f6e6963}\]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetVolumeNameForVolumeMountPointW   Address:  0x76a80e20
  Params:  [NULL, \\?\Volume{a4dcb962-c2b8-11e2-8b83-806e6f6e6963}\]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetTokenInformation   Address:  0x76a80172
  Params:  [0x1a8, 0x19]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  advapi32.dll
	604
API Call

  API Name:  GetTokenInformation   Address:  0x76a80172
  Params:  [0x1a8, 0x19]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  advapi32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\Administrator\AppData\Roaming\TOR
	604
4 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Network
Listen

  Protocol  Type:  tcp   Listen  Port:  49199   IP Address:  127.0.0.1:49199
  Imagepath:  c:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
Malicious  Alert
Network  Activity

Message:   TCP listen port opened

Network
Connect

  Protocol  Type:  tcp   Destination  Port:  49199   IP Address:  127.0.0.1
  Imagepath:  c:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
Malicious  Alert
Network  Activity

Message:   Network outbound communication attempted

Network
Listen

  Protocol  Type:  tcp   Listen  Port:  31721   IP Address:  127.0.0.1:31721
  Imagepath:  c:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
File
Created

C:\Users\Administrator\AppData\Local\Temp\6893A5D897\lock
	604
File
Created

C:\Users\Administrator\AppData\Local\Temp\6893A5D897\state.tmp
	604
File
Close

C:\Users\Administrator\AppData\Local\Temp\6893A5D897\state.tmp
  MD5:  34c7720364200078cf8cd1aefda03843
  SHA1: 0cf818b11aa01a437fa5940fa265f60c6745d363
	604	 	199
File
Rename

Old Name:   C:\Users\Administrator\AppData\Local\Temp\6893A5D897\state.tmp
New Name:   C:\Users\Administrator\AppData\Local\Temp\6893A5D897\state
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  34c7720364200078cf8cd1aefda03843
  SHA1: 0cf818b11aa01a437fa5940fa265f60c6745d363
	604	 	199
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\ROUTER-STABILITY
	604
File
Failed

C:\Users\Administrator\AppData\Roaming\TOR\GEOIP
	604
File
Failed

C:\Users\Administrator\AppData\Roaming\TOR\GEOIP6
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-CERTS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-CONSENSUS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\UNVERIFIED-CONSENSUS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-MICRODESC-CONSENSUS
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\UNVERIFIED-MICRODESC-CONSENSUS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-MICRODESCS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-MICRODESCS.NEW
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-DESCRIPTORS
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\6893A5~1\CACHED-EXTRAINFO
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
3 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
3 Repeated items skipped
API Call

  API Name:  GetSystemDirectoryA   Address:  0x004f8683
  Params:  [0x265f8f4, 260]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\WINNSI.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC6.DLL
	604
File
Failed

C:\Users\ADMINI~1\AppData\Local\Temp\DHCPCSVC.DLL
	604
API Call

  API Name:  GetSystemDirectoryA   Address:  0x004f8683
  Params:  [0x265f8f4, 260]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
4 Repeated items skipped
Uac
Service

Multimedia Class Scheduler

ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Uac
Service

Multimedia Class Scheduler

ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
3 Repeated items skipped
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
4 Repeated items skipped
Malicious  Alert
High Repeated Sleep Calls

Message:   High repeated sleep calls

API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
4 Repeated items skipped
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xmode" = 798
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xpk" = -----BEGIN PUBLIC KEY-----.MII
   BojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvfD/CUBDvPpIFqwP8nlu.35tyUUJpY1lTKUfNN7v8OvxnMUe6ymFY9z/
   ZuqtLM8SGx2ZcR5Tr+QRQ319nwTSc.fabkNUQQLTwluHoVVp2xVQ2s2ygrdL0xKJOO/RIhh0wLg9tjpakvIfCXkRCaze14.Vc
   ZEWlfqxPn6a27qUoaUYqDxt5wJtF7hFjPTS8N6XnpiXzkxCOE9rRS1PkNH33LI.CHD4UfBYvouMUSG8tqHB9krzNoTyPLZefI
   +tNZSjPOn87HldAk8WkOkVT8HudVq6.MopiDGq34d3R2tDr4uhFs5+oqeU4/LkCC2YQalLPfxRkFXti0cKi76O2PJKbCdtb.O
   QwD6fQf0O7hGrMXtd0Th7nXGqkaXbeESCMmSY88XkUoE4CB+TGoFuBpKLtAH8FZ.naZjGd2RzOpt0Ujk0Huk2qaJzWVMh0
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xstate" = 3
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 0
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00412f62
  Params:  [0x33ef2d8, 1024]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x18f1c8, 1024]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Created

C:\README1.txt
	604
File
Close

C:\README1.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README2.txt
	604
File
Close

C:\README2.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README3.txt
	604
File
Close

C:\README3.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README4.txt
	604
File
Close

C:\README4.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README5.txt
	604
File
Close

C:\README5.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README6.txt
	604
File
Close

C:\README6.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README7.txt
	604
File
Close

C:\README7.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README8.txt
	604
File
Close

C:\README8.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README9.txt
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x18ef08, 1024]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Close

C:\README9.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
File
Created

C:\README10.txt
	604
File
Close

C:\README10.txt
  MD5:  c1c8aa778ab31b146974da08d9259ecd
  SHA1: cf3a7a326d7907c566b4e7a61b0b7f2505983473
	604	 	2136
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xstate" = 4
	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x352f540, 1024]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
File
Find

C:\*
	604
File
Find

C:\Users\*
	604
File
Open

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
	604	 	26246026
Process
Started

C:\Windows\System32\vssadmin.exe
  Parentname:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  Command Line:  C:\Windows\system32\vssadmin.exe List Shadows
  MD5:  e23dd973e1444684eb36365deff1fc74
  SHA1: 09fafeb1b8404124b33c44440be7e3fdb6105f8a
	1048	604	167424
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 0
	604
91 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Mutex

\Sessions\1\BaseNamedObjects\DBWinMutex
	1048
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	1048
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 0
	604
4 Repeated items skipped
Uac
Service

Volume Shadow Copy

Uac
Service

Microsoft Software Shadow Copy Provider

Process
Terminated

C:\Windows\System32\vssadmin.exe
  Parentname:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  Command Line:  N/A
	1048	604
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00412f62
  Params:  [0x33ef2d8, 1024]
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Process
Started

C:\Windows\System32\vssadmin.exe
  Parentname:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  Command Line:  C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
  MD5:  e23dd973e1444684eb36365deff1fc74
  SHA1: 09fafeb1b8404124b33c44440be7e3fdb6105f8a
	1808	604	167424
Malicious  Alert
Disk  Tampering  Activity

Message:   Disk Tampering

Malicious  Alert
Misc  Anom

Message:   Disk Tampering Detected

Mutex

\Sessions\1\BaseNamedObjects\DBWinMutex
	1808
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	1808
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 0
	604
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 0
	604
13 Repeated items skipped
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
File
Close

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
  MD5:  d783aa11bdc83430f9d30ef39c37eb3e
  SHA1: b9aca26b0ffb2eb52362c8f82f198d894905a6ef
	604	 	26246410
File
Open

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
  MD5:  d783aa11bdc83430f9d30ef39c37eb3e
  SHA1: b9aca26b0ffb2eb52362c8f82f198d894905a6ef
	604	 	26246410
High  Cpu

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
File
Close

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
  MD5:  0b366962504e9d26ede7554a1e543f1c
  SHA1: 142c7498960f43bf5abea19bd4511ba2008df44e
	604	 	26246416
File
Rename

Old Name:   C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
New Name:   C:\Users\Public\Videos\Sample Videos\wDz6On8qmqltEd3LYIQIv4Rp+qEXQxh1KJpZlElW-5c=.7A2F0ADB1B90B147DA
   BB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  0b366962504e9d26ede7554a1e543f1c
  SHA1: 142c7498960f43bf5abea19bd4511ba2008df44e
	604	 	26246416
File
Failed

C:\ProgramData\SYSTEM32
	604
Folder
Created

C:\ProgramData\System32
	604
Folder
Hide

C:\ProgramData\System32
	604
File
Failed

C:\ProgramData\System32\XFS
	604
File
Created

C:\ProgramData\System32\xfs
	604
File
Close

C:\ProgramData\System32\xfs
  MD5:  b40e775927a2f1c38d960921b60d7a8d
  SHA1: 46091bdfdb005fcaabf9489768fa9954907fe124
	604	 	134
File
Hide

C:\ProgramData\System32\xfs
  MD5:  b40e775927a2f1c38d960921b60d7a8d
  SHA1: 46091bdfdb005fcaabf9489768fa9954907fe124
	604	 	134
File
Open

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
	604	 	620888
File
Close

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  MD5:  886b76b7e667b07eb384aef6b287dd8f
  SHA1: fa4710759b26074bc1071cb460845e03e4fbf961
	604	 	621272
File
Open

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  MD5:  886b76b7e667b07eb384aef6b287dd8f
  SHA1: fa4710759b26074bc1071cb460845e03e4fbf961
	604	 	621272
File
Close

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
  MD5:  eb5c740ca5e6b82f98731606438d2949
  SHA1: 1b0c15cbe0738dccfde2694b0609ce3f0367a551
	604	 	621280
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\PF+Cxm3VmNNzOXBRmkDH+Hg9aO+zrZWwFtNUkj2M0go=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  eb5c740ca5e6b82f98731606438d2949
  SHA1: 1b0c15cbe0738dccfde2694b0609ce3f0367a551
	604	 	621280
File
Open

C:\ProgramData\System32\xfs
  MD5:  b40e775927a2f1c38d960921b60d7a8d
  SHA1: 46091bdfdb005fcaabf9489768fa9954907fe124
	604	 	134
File
Close

C:\ProgramData\System32\xfs
  MD5:  28da47be3cb23f6c66160ea208cfd372
  SHA1: a8525efdf940b2d2202cd8f78b044c72053c2645
	604	 	274
File
Hide

C:\ProgramData\System32\xfs
  MD5:  28da47be3cb23f6c66160ea208cfd372
  SHA1: a8525efdf940b2d2202cd8f78b044c72053c2645
	604	 	274
File
Open

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
	604	 	777835
File
Close

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  MD5:  433508676ab1e8516196371912f0c31d
  SHA1: f99cd9c7206459d0ad5e8c2d31266c004ddce650
	604	 	778219
File
Open

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  MD5:  433508676ab1e8516196371912f0c31d
  SHA1: f99cd9c7206459d0ad5e8c2d31266c004ddce650
	604	 	778219
File
Close

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
  MD5:  a12ed00d8d6a54423cef5e58a703ed44
  SHA1: 316d8eb4b55845f8df72d76251e2b979a1930048
	604	 	778224
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\L6bCSak2OI8V7u+sAHjsPsx58Q++QKWQvcU4Zscstn4=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  a12ed00d8d6a54423cef5e58a703ed44
  SHA1: 316d8eb4b55845f8df72d76251e2b979a1930048
	604	 	778224
File
Open

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
	604	 	561276
File
Open

C:\ProgramData\System32\xfs
  MD5:  28da47be3cb23f6c66160ea208cfd372
  SHA1: a8525efdf940b2d2202cd8f78b044c72053c2645
	604	 	274
File
Close

C:\ProgramData\System32\xfs
  MD5:  cb3ba0321674d2aed9570bc5ef2b9632
  SHA1: 878f39613d12a8ba5f0e2c67e0b5558b225768ab
	604	 	418
File
Hide

C:\ProgramData\System32\xfs
  MD5:  cb3ba0321674d2aed9570bc5ef2b9632
  SHA1: 878f39613d12a8ba5f0e2c67e0b5558b225768ab
	604	 	418
File
Close

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  MD5:  c8f6785d95696592ae266486a46297eb
  SHA1: a61306f72a7368c47f3574dad6a098add3ec6712
	604	 	561660
File
Open

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  MD5:  c8f6785d95696592ae266486a46297eb
  SHA1: a61306f72a7368c47f3574dad6a098add3ec6712
	604	 	561660
File
Close

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
  MD5:  28df3d0418dece2e132c76b96d01c36a
  SHA1: 4cb0d2d02a5ffaab5f6728ba84c8587ab73a5c6c
	604	 	561664
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\P1XoWVaGq1E9j6v6sSwA4i13OmeNmtZAaHIkklpMjDE=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  28df3d0418dece2e132c76b96d01c36a
  SHA1: 4cb0d2d02a5ffaab5f6728ba84c8587ab73a5c6c
	604	 	561664
File
Open

C:\ProgramData\System32\xfs
  MD5:  cb3ba0321674d2aed9570bc5ef2b9632
  SHA1: 878f39613d12a8ba5f0e2c67e0b5558b225768ab
	604	 	418
File
Close

C:\ProgramData\System32\xfs
  MD5:  317508a377eb4904e7952e644d5083dc
  SHA1: d3d817cbb73e349f18b26f6bfcd7c4c6a24f8aa3
	604	 	566
File
Hide

C:\ProgramData\System32\xfs
  MD5:  317508a377eb4904e7952e644d5083dc
  SHA1: d3d817cbb73e349f18b26f6bfcd7c4c6a24f8aa3
	604	 	566
File
Open

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
	604	 	780831
File
Close

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
  MD5:  d07c705f4953407438ca30909060c103
  SHA1: af30f25c6dafd4fe1fb5eec131390a2ae82025a2
	604	 	781215
File
Open

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
  MD5:  d07c705f4953407438ca30909060c103
  SHA1: af30f25c6dafd4fe1fb5eec131390a2ae82025a2
	604	 	781215
File
Close

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
  MD5:  c9338c52434123f2f54a3c3457408a83
  SHA1: 41f485b26b432898c4f60483fae47a91d6e03522
	604	 	781216
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\MvqtZijbhCa1ApycV7KdoZ7JrtsU71jZY7OClDl7riA=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  c9338c52434123f2f54a3c3457408a83
  SHA1: 41f485b26b432898c4f60483fae47a91d6e03522
	604	 	781216
File
Open

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
	604	 	775702
File
Open

C:\ProgramData\System32\xfs
  MD5:  317508a377eb4904e7952e644d5083dc
  SHA1: d3d817cbb73e349f18b26f6bfcd7c4c6a24f8aa3
	604	 	566
File
Close

C:\ProgramData\System32\xfs
  MD5:  1fb7bd9abd449ec8bb2b47efba621de6
  SHA1: c2eeaece9396846ea37db7c08f8f0cdff49e11b0
	604	 	704
File
Hide

C:\ProgramData\System32\xfs
  MD5:  1fb7bd9abd449ec8bb2b47efba621de6
  SHA1: c2eeaece9396846ea37db7c08f8f0cdff49e11b0
	604	 	704
File
Close

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  MD5:  f4f3a2cb8e7fd3149570f217df1b57f3
  SHA1: f73cb686a9d10bfb04cdcdf22f5bbd61affee844
	604	 	776086
File
Open

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  MD5:  f4f3a2cb8e7fd3149570f217df1b57f3
  SHA1: f73cb686a9d10bfb04cdcdf22f5bbd61affee844
	604	 	776086
File
Close

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
  MD5:  9227c7f3ad19d90117759eb63a39892b
  SHA1: 41b542ff591636ae3049e01a4cf5bb20235e2048
	604	 	776096
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\nWfUYd5BKpzXCqQM483O0dY21f-4V-f5xQolZKlJLUo=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  9227c7f3ad19d90117759eb63a39892b
  SHA1: 41b542ff591636ae3049e01a4cf5bb20235e2048
	604	 	776096
File
Open

C:\ProgramData\System32\xfs
  MD5:  1fb7bd9abd449ec8bb2b47efba621de6
  SHA1: c2eeaece9396846ea37db7c08f8f0cdff49e11b0
	604	 	704
File
Close

C:\ProgramData\System32\xfs
  MD5:  bc7d33ef94aa0ab5fcb4ea1e713d2819
  SHA1: 814596c41c2830454d800eb93c8fc0ec3c86600f
	604	 	850
File
Hide

C:\ProgramData\System32\xfs
  MD5:  bc7d33ef94aa0ab5fcb4ea1e713d2819
  SHA1: 814596c41c2830454d800eb93c8fc0ec3c86600f
	604	 	850
File
Open

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
	604	 	595284
File
Close

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  MD5:  438259ecbb7bd3d922aaed01b156d36e
  SHA1: 77eeab4898cedcd399bd7d696a91fb70f8ad5524
	604	 	595668
File
Open

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  MD5:  438259ecbb7bd3d922aaed01b156d36e
  SHA1: 77eeab4898cedcd399bd7d696a91fb70f8ad5524
	604	 	595668
File
Close

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
  MD5:  ccf3b949f31cd3f0e96f9112f09b97df
  SHA1: 99e901d9d10e80dddcac20a9c3e81d55f6ec873a
	604	 	595680
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\PsKe54J-2GeOdO1RDI+dDZsdmBIqXthkOttHJtvKjx4=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ccf3b949f31cd3f0e96f9112f09b97df
  SHA1: 99e901d9d10e80dddcac20a9c3e81d55f6ec873a
	604	 	595680
File
Open

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
	604	 	845941
File
Open

C:\ProgramData\System32\xfs
  MD5:  bc7d33ef94aa0ab5fcb4ea1e713d2819
  SHA1: 814596c41c2830454d800eb93c8fc0ec3c86600f
	604	 	850
File
Close

C:\ProgramData\System32\xfs
  MD5:  1b872bad3231d1f5b7895c79d95bcf9a
  SHA1: 0b8ea004023d5d1bb02c7b9d842671e674c2b1f5
	604	 	998
File
Hide

C:\ProgramData\System32\xfs
  MD5:  1b872bad3231d1f5b7895c79d95bcf9a
  SHA1: 0b8ea004023d5d1bb02c7b9d842671e674c2b1f5
	604	 	998
File
Close

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
  MD5:  e3934c1d8793e85f1803223fed15729a
  SHA1: 6fbb08dfc191a4a4bfac272568c1c665cf0207bc
	604	 	846325
File
Open

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
  MD5:  e3934c1d8793e85f1803223fed15729a
  SHA1: 6fbb08dfc191a4a4bfac272568c1c665cf0207bc
	604	 	846325
File
Close

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
  MD5:  991dac7cd99303c3beec2c511d5e69bb
  SHA1: 007517900e8ba6b8050cf1573a997e1f3ecf3fa4
	604	 	846336
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\dmYzOCvVXR1Qu6XiXec9SHLa1VXU0QmJOBSicQx9qp0=.7A2F0ADB1B90B1
   47DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  991dac7cd99303c3beec2c511d5e69bb
  SHA1: 007517900e8ba6b8050cf1573a997e1f3ecf3fa4
	604	 	846336
File
Open

C:\ProgramData\System32\xfs
  MD5:  1b872bad3231d1f5b7895c79d95bcf9a
  SHA1: 0b8ea004023d5d1bb02c7b9d842671e674c2b1f5
	604	 	998
File
Close

C:\ProgramData\System32\xfs
  MD5:  994dcbd48b9991af156b930045cb72e9
  SHA1: 2e4884b50791276e2e904b2c6504aec25e90bf2f
	604	 	1138
File
Hide

C:\ProgramData\System32\xfs
  MD5:  994dcbd48b9991af156b930045cb72e9
  SHA1: 2e4884b50791276e2e904b2c6504aec25e90bf2f
	604	 	1138
File
Open

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
	604	 	879394
File
Close

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  MD5:  129068ff72cbf9de8cd5b8e03fd8e94f
  SHA1: 639df059dfbed864eb2891ca045b65f88c035f5b
	604	 	879778
File
Open

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  MD5:  129068ff72cbf9de8cd5b8e03fd8e94f
  SHA1: 639df059dfbed864eb2891ca045b65f88c035f5b
	604	 	879778
File
Close

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
  MD5:  e8573bee38743e11eb978a11be66dcb0
  SHA1: b9190d7363f16ed119e1a8f005ed4b919ecfb6a5
	604	 	879792
File
Rename

Old Name:   C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
New Name:   C:\Users\Public\Pictures\Sample Pictures\SSV3w8pmgstpqHUT18WJ02KZK8X8BkgUeli8i++4Ftn09ijdKKeYRg6qljm
   dQd5d.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  e8573bee38743e11eb978a11be66dcb0
  SHA1: b9190d7363f16ed119e1a8f005ed4b919ecfb6a5
	604	 	879792
File
Open

C:\ProgramData\System32\xfs
  MD5:  994dcbd48b9991af156b930045cb72e9
  SHA1: 2e4884b50791276e2e904b2c6504aec25e90bf2f
	604	 	1138
File
Close

C:\ProgramData\System32\xfs
  MD5:  268ca2df059c5a9ce5c26ef6f85d924f
  SHA1: 9501783d1aa3c4fa8eb4976d8f1a5d58b505036b
	604	 	1292
File
Hide

C:\ProgramData\System32\xfs
  MD5:  268ca2df059c5a9ce5c26ef6f85d924f
  SHA1: 9501783d1aa3c4fa8eb4976d8f1a5d58b505036b
	604	 	1292
File
Open

C:\Users\Public\Music\Sample Music\Sleep Away.mp3
	604	 	4842585
File
Close

C:\Users\Public\Music\Sample Music\Sleep Away.mp3
  MD5:  c67bbe427a8711f75d2d7d2719417d61
  SHA1: d3a1aa8d8077e6774916c461d07c1721f9773aad
	604	 	4842969
File
Open

C:\Users\Public\Music\Sample Music\Sleep Away.mp3
  MD5:  c67bbe427a8711f75d2d7d2719417d61
  SHA1: d3a1aa8d8077e6774916c461d07c1721f9773aad
	604	 	4842969
File
Close

C:\Users\Public\Music\Sample Music\Sleep Away.mp3
  MD5:  f8986b2b08c2fbce2ee85a846a7f001c
  SHA1: cc9f89632d710db0ff9d2ee811807a8015c2f642
	604	 	4842976
File
Rename

Old Name:   C:\Users\Public\Music\Sample Music\Sleep Away.mp3
New Name:   C:\Users\Public\Music\Sample Music\Hnz3Uc0S-lbrqf7X69HranOJBU35BAtGbdmuXtz7YX8=.7A2F0ADB1B90B147DABB
   .no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  f8986b2b08c2fbce2ee85a846a7f001c
  SHA1: cc9f89632d710db0ff9d2ee811807a8015c2f642
	604	 	4842976
File
Open

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
	604	 	4113874
File
Open

C:\ProgramData\System32\xfs
  MD5:  268ca2df059c5a9ce5c26ef6f85d924f
  SHA1: 9501783d1aa3c4fa8eb4976d8f1a5d58b505036b
	604	 	1292
File
Close

C:\ProgramData\System32\xfs
  MD5:  f10c079071c47cfd58918e3e72920aa5
  SHA1: a16470bf1d09f96060a918a6b4f0f46a1863888b
	604	 	1428
File
Hide

C:\ProgramData\System32\xfs
  MD5:  f10c079071c47cfd58918e3e72920aa5
  SHA1: a16470bf1d09f96060a918a6b4f0f46a1863888b
	604	 	1428
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 10
	604
File
Close

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  MD5:  52ec85f46d9f1164792a3489ecf81009
  SHA1: f7ff3b7fbfb36e2eda9f04e86ef60f2d2bb6cbef
	604	 	4114258
File
Open

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  MD5:  52ec85f46d9f1164792a3489ecf81009
  SHA1: f7ff3b7fbfb36e2eda9f04e86ef60f2d2bb6cbef
	604	 	4114258
File
Close

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
  MD5:  5b3f9e01fc83f4f441ad7b67af09f11e
  SHA1: 80a3ee5a53c48bdc94549e0fdfdbaa28ad261c1a
	604	 	4114272
File
Rename

Old Name:   C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
New Name:   C:\Users\Public\Music\Sample Music\EpG22a-RASJeJaFSbWvusDTLftbNTaghcy35AJsBoRg6Gr7rDhJH+DPMqrAO7VE+A
   VBtZEVXIrcl5OsEpSrNCg==.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  5b3f9e01fc83f4f441ad7b67af09f11e
  SHA1: 80a3ee5a53c48bdc94549e0fdfdbaa28ad261c1a
	604	 	4114272
File
Open

C:\ProgramData\System32\xfs
  MD5:  f10c079071c47cfd58918e3e72920aa5
  SHA1: a16470bf1d09f96060a918a6b4f0f46a1863888b
	604	 	1428
File
Close

C:\ProgramData\System32\xfs
  MD5:  9f0a52ec410dc015bbbdb5006476fbee
  SHA1: 31abdb3951e1fe8c6f6476f75092d58239f4be23
	604	 	1594
File
Hide

C:\ProgramData\System32\xfs
  MD5:  9f0a52ec410dc015bbbdb5006476fbee
  SHA1: 31abdb3951e1fe8c6f6476f75092d58239f4be23
	604	 	1594
File
Open

C:\Users\Public\Music\Sample Music\Kalimba.mp3
	604	 	8414449
File
Close

C:\Users\Public\Music\Sample Music\Kalimba.mp3
  MD5:  b15d6f2196d8e2ddd256524f5662276f
  SHA1: c142f307dd2cdddb9979a369c02024e804074d56
	604	 	8414833
File
Open

C:\Users\Public\Music\Sample Music\Kalimba.mp3
  MD5:  b15d6f2196d8e2ddd256524f5662276f
  SHA1: c142f307dd2cdddb9979a369c02024e804074d56
	604	 	8414833
File
Close

C:\Users\Public\Music\Sample Music\Kalimba.mp3
  MD5:  1783edfd94f1bba7359238e705b298db
  SHA1: df3780405e90cea5622471ef3ab094c0191641a8
	604	 	8414848
File
Rename

Old Name:   C:\Users\Public\Music\Sample Music\Kalimba.mp3
New Name:   C:\Users\Public\Music\Sample Music\FgPA-zefXcNw-zR2AvLhpmeRnLkAQImTuqhcDdL0E9E=.7A2F0ADB1B90B147DABB
   .no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  1783edfd94f1bba7359238e705b298db
  SHA1: df3780405e90cea5622471ef3ab094c0191641a8
	604	 	8414848
File
Open

C:\ProgramData\System32\xfs
  MD5:  9f0a52ec410dc015bbbdb5006476fbee
  SHA1: 31abdb3951e1fe8c6f6476f75092d58239f4be23
	604	 	1594
File
Close

C:\ProgramData\System32\xfs
  MD5:  d1a4f2392188feb2397890f63cc5c953
  SHA1: 3fd70395c041bca61e57e211552182b36101321d
	604	 	1724
Ransom

C:\Users\Public\Music\cocpFV_ihD.wav
MD5:  615f35a9891ba630998f6aa13ef45054

Malicious  Alert
Ransomware

Message:   Ransomware Activity

Malicious  Alert
Misc  Anom

Message:   Ransomware Activity

File
Hide

C:\ProgramData\System32\xfs
  MD5:  d1a4f2392188feb2397890f63cc5c953
  SHA1: 3fd70395c041bca61e57e211552182b36101321d
	604	 	1724
File
Open

C:\ProgramData\System32\xfs
  MD5:  d1a4f2392188feb2397890f63cc5c953
  SHA1: 3fd70395c041bca61e57e211552182b36101321d
	604	 	1724
File
Failed

C:\Users\Public\Documents\My Videos
	604
File
Close

C:\ProgramData\System32\xfs
  MD5:  4cceb2f587948af3b0d8e06cb1f64bbe
  SHA1: 9b6c5e693f25c392fcda60fcbaca508a94d49e7e
	604	 	1834
File
Failed

C:\Users\Public\Documents\My Pictures
	604
File
Failed

C:\Users\Public\Documents\My Music
	604
File
Hide

C:\ProgramData\System32\xfs
  MD5:  4cceb2f587948af3b0d8e06cb1f64bbe
  SHA1: 9b6c5e693f25c392fcda60fcbaca508a94d49e7e
	604	 	1834
Ransom

C:\Users\Public\Documents\cZLDe-\xTnfgLg.jpg
MD5:  e0b0209e3c8107371d32a0cd757f907f

Ransom

C:\Users\Public\Documents\cZLDe-\WiPLiBqrX.doc
MD5:  c25bd3988639d7aa8be215a50c5bf089

Ransom

C:\Users\Public\Documents\cZLDe-\NxoFCO.xls
MD5:  e17db3c35a95beef2652b2044b08a9d5

File
Open

C:\ProgramData\System32\xfs
  MD5:  4cceb2f587948af3b0d8e06cb1f64bbe
  SHA1: 9b6c5e693f25c392fcda60fcbaca508a94d49e7e
	604	 	1834
File
Close

C:\ProgramData\System32\xfs
  MD5:  a91b81161b47cb9f591c1b8312201022
  SHA1: 7a6712f8a35290edccd948478c2ea884aa1cf15d
	604	 	2022
File
Hide

C:\ProgramData\System32\xfs
  MD5:  a91b81161b47cb9f591c1b8312201022
  SHA1: 7a6712f8a35290edccd948478c2ea884aa1cf15d
	604	 	2022
Ransom

C:\Users\Public\Documents\cZLDe-\LG-Lu.txt
MD5:  0a7d2ce4812613c448457291faa21395

File
Open

C:\ProgramData\System32\xfs
  MD5:  a91b81161b47cb9f591c1b8312201022
  SHA1: 7a6712f8a35290edccd948478c2ea884aa1cf15d
	604	 	2022
File
Close

C:\ProgramData\System32\xfs
  MD5:  96248bd1ec5f8e539800db84f2e97f3e
  SHA1: 991d080d499317fa1d77d436bfba1c6d93fd42bc
	604	 	2146
File
Hide

C:\ProgramData\System32\xfs
  MD5:  96248bd1ec5f8e539800db84f2e97f3e
  SHA1: 991d080d499317fa1d77d436bfba1c6d93fd42bc
	604	 	2146
Ransom

C:\Users\Public\Documents\cZLDe-\cyhuszTB.html
MD5:  e643ac556bc2ebc061394e77fdad5f8a

File
Open

C:\ProgramData\System32\xfs
  MD5:  96248bd1ec5f8e539800db84f2e97f3e
  SHA1: 991d080d499317fa1d77d436bfba1c6d93fd42bc
	604	 	2146
File
Close

C:\ProgramData\System32\xfs
  MD5:  56ea7cb505271706cb2974c749cf6aed
  SHA1: f4e3373ce1e95fe99e06890b06f731600f90e47d
	604	 	2268
File
Hide

C:\ProgramData\System32\xfs
  MD5:  56ea7cb505271706cb2974c749cf6aed
  SHA1: f4e3373ce1e95fe99e06890b06f731600f90e47d
	604	 	2268
Ransom

C:\Users\Public\Documents\cZLDe-\CAMEu.ppt
MD5:  adf9de9ecd1bd9da5beb369d4e200bbc

File
Open

C:\ProgramData\System32\xfs
  MD5:  56ea7cb505271706cb2974c749cf6aed
  SHA1: f4e3373ce1e95fe99e06890b06f731600f90e47d
	604	 	2268
File
Close

C:\ProgramData\System32\xfs
  MD5:  16c2db7f9420440cdb48f666e8101fb9
  SHA1: c4a9d85e5c35abffd4ffa70089d484e9703c0767
	604	 	2398
File
Hide

C:\ProgramData\System32\xfs
  MD5:  16c2db7f9420440cdb48f666e8101fb9
  SHA1: c4a9d85e5c35abffd4ffa70089d484e9703c0767
	604	 	2398
File
Failed

C:\Users\Default User
	604
File
Open

C:\ProgramData\System32\xfs
  MD5:  16c2db7f9420440cdb48f666e8101fb9
  SHA1: c4a9d85e5c35abffd4ffa70089d484e9703c0767
	604	 	2398
File
Close

C:\ProgramData\System32\xfs
  MD5:  6b82c25051991da4145c958aedd3c587
  SHA1: dc822231e62f03a6198be7435f1360ff28ae53d7
	604	 	2520
File
Hide

C:\ProgramData\System32\xfs
  MD5:  6b82c25051991da4145c958aedd3c587
  SHA1: dc822231e62f03a6198be7435f1360ff28ae53d7
	604	 	2520
File
Failed

C:\Users\Default\Templates
	604
File
Failed

C:\Users\Default\Start Menu
	604
File
Failed

C:\Users\Default\SendTo
	604
File
Failed

C:\Users\Default\Recent
	604
File
Failed

C:\Users\Default\PrintHood
	604
File
Failed

C:\Users\Default\NetHood
	604
File
Failed

C:\Users\Default\My Documents
	604
File
Failed

C:\Users\Default\Local Settings
	604
File
Failed

C:\Users\Default\Documents\My Videos
	604
File
Failed

C:\Users\Default\Documents\My Pictures
	604
File
Failed

C:\Users\Default\Documents\My Music
	604
File
Failed

C:\Users\Default\Cookies
	604
File
Failed

C:\Users\Default\Application Data
	604
Folder
Open

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies
	604
File
Failed

C:\Users\Default\AppData\Local\Temporary Internet Files
	604
File
Failed

C:\Users\Default\AppData\Local\History
	604
File
Failed

C:\Users\Default\AppData\Local\Application Data
	604
File
Open

C:\Users\Default\NTUSER.DAT.LOG
	604	 	1024
File
Close

C:\Users\Default\NTUSER.DAT.LOG
  MD5:  1d37b69cef8145013c7c4519e74a3e05
  SHA1: 00966e36b522b98fb24387a6a372d54dbfae959f
	604	 	1408
File
Open

C:\Users\Default\NTUSER.DAT.LOG
  MD5:  1d37b69cef8145013c7c4519e74a3e05
  SHA1: 00966e36b522b98fb24387a6a372d54dbfae959f
	604	 	1408
File
Close

C:\Users\Default\NTUSER.DAT.LOG
  MD5:  a68649a030493c9a3fced34a9ce79a7e
  SHA1: a6a8cd80c4047637cf2be65df9170f86b2262614
	604	 	1408
File
Rename

Old Name:   C:\Users\Default\NTUSER.DAT.LOG
New Name:   C:\Users\Default\BQhNoa4s-9gCT5aupZN6EbhSBui8gZbaRaM-QkkmIH0=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  a68649a030493c9a3fced34a9ce79a7e
  SHA1: a6a8cd80c4047637cf2be65df9170f86b2262614
	604	 	1408
File
Failed

C:\ProgramData\Templates
	604
File
Open

C:\ProgramData\System32\xfs
  MD5:  6b82c25051991da4145c958aedd3c587
  SHA1: dc822231e62f03a6198be7435f1360ff28ae53d7
	604	 	2520
File
Close

C:\ProgramData\System32\xfs
  MD5:  7324dcd92102e0493238e75bfb9f54bf
  SHA1: 9e2d759db27084b0081a8798885fc5aeeb68195a
	604	 	2620
File
Hide

C:\ProgramData\System32\xfs
  MD5:  7324dcd92102e0493238e75bfb9f54bf
  SHA1: 9e2d759db27084b0081a8798885fc5aeeb68195a
	604	 	2620
File
Open

C:\ProgramData\Sun\Java\Java Update\jaureglist.xml
	604	 	185
File
Close

C:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  MD5:  bf79db17f612fd0716bd9170bcd87a44
  SHA1: 2a4a45d42c9343831b44b3bfee81a99e19ad236e
	604	 	569
File
Open

C:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  MD5:  bf79db17f612fd0716bd9170bcd87a44
  SHA1: 2a4a45d42c9343831b44b3bfee81a99e19ad236e
	604	 	569
File
Close

C:\ProgramData\Sun\Java\Java Update\jaureglist.xml
  MD5:  45f89a51335bc5ab6dc2ec60daad3e9e
  SHA1: 36be167bb9eb1d819bd2526153f560fbada3e067
	604	 	576
File
Rename

Old Name:   C:\ProgramData\Sun\Java\Java Update\jaureglist.xml
New Name:   C:\ProgramData\Sun\Java\Java Update\fYkCjj2U4HrlixMS2nUUVqyPc1sypGnN3YbW3H3bHbQ=.7A2F0ADB1B90B147DAB
   B.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  45f89a51335bc5ab6dc2ec60daad3e9e
  SHA1: 36be167bb9eb1d819bd2526153f560fbada3e067
	604	 	576
File
Failed

C:\ProgramData\Start Menu
	604
File
Open

C:\ProgramData\System32\xfs
  MD5:  7324dcd92102e0493238e75bfb9f54bf
  SHA1: 9e2d759db27084b0081a8798885fc5aeeb68195a
	604	 	2620
File
Close

C:\ProgramData\System32\xfs
  MD5:  e55b310507ede3a193041b7956e3851a
  SHA1: b0564de0148a5c0dbf0ba9f47fe218af55951e10
	604	 	2766
File
Hide

C:\ProgramData\System32\xfs
  MD5:  e55b310507ede3a193041b7956e3851a
  SHA1: b0564de0148a5c0dbf0ba9f47fe218af55951e10
	604	 	2766
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Scripts\bookmark.js
	604	 	12021
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Scripts\bookmark.js
  MD5:  2777bcceafc88c5f3635c4c848df6a29
  SHA1: 3f001b3a8d45013ba5608078fcd97e85c02e147d
	604	 	12405
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Scripts\bookmark.js
  MD5:  2777bcceafc88c5f3635c4c848df6a29
  SHA1: 3f001b3a8d45013ba5608078fcd97e85c02e147d
	604	 	12405
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Scripts\bookmark.js
  MD5:  6004bdd76a27d75493790767c7df3811
  SHA1: 0dc21a79945f6bf787238409bdfd5f1c963e311f
	604	 	12416
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\Scripts\bookmark.js
New Name:   C:\ProgramData\RealNetworks\RealDownloader\Scripts\PYFOq5l4lSRFeX3z6RtrpN5Tg3Kd1AWB-NmFIXE36+g=.7A2F
   0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  6004bdd76a27d75493790767c7df3811
  SHA1: 0dc21a79945f6bf787238409bdfd5f1c963e311f
	604	 	12416
File
Open

C:\ProgramData\System32\xfs
  MD5:  e55b310507ede3a193041b7956e3851a
  SHA1: b0564de0148a5c0dbf0ba9f47fe218af55951e10
	604	 	2766
File
Close

C:\ProgramData\System32\xfs
  MD5:  380f12b8a50094222da495f9ca461bd7
  SHA1: d552545fa355133decefbeb85b162a836b753bcf
	604	 	2936
File
Hide

C:\ProgramData\System32\xfs
  MD5:  380f12b8a50094222da495f9ca461bd7
  SHA1: d552545fa355133decefbeb85b162a836b753bcf
	604	 	2936
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Flash\sharemedia.swf
	604	 	860148
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Flash\sharemedia.swf
  MD5:  47267d3bf7b348b0e57f6dcb78805661
  SHA1: bef6cdc18df5747147ac16b4688501188d20640a
	604	 	860532
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Flash\sharemedia.swf
  MD5:  47267d3bf7b348b0e57f6dcb78805661
  SHA1: bef6cdc18df5747147ac16b4688501188d20640a
	604	 	860532
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Flash\sharemedia.swf
  MD5:  db807af7c8df283ae927b50dc6b212e7
  SHA1: 909c5802798cfa8afd84ffb21fbdeefd4bcf2cac
	604	 	860544
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\Flash\sharemedia.swf
New Name:   C:\ProgramData\RealNetworks\RealDownloader\Flash\po7-b-4o652uQo5+N7pcKtl8hE2UfB5lQjtRNi5-Veg=.7A2F0A
   DB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  db807af7c8df283ae927b50dc6b212e7
  SHA1: 909c5802798cfa8afd84ffb21fbdeefd4bcf2cac
	604	 	860544
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Downloader\madatastore.dat
	604	 	80
File
Open

C:\ProgramData\System32\xfs
  MD5:  380f12b8a50094222da495f9ca461bd7
  SHA1: d552545fa355133decefbeb85b162a836b753bcf
	604	 	2936
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Downloader\madatastore.dat
  MD5:  2a5c34227a08c0d1979539b2810aa152
  SHA1: d310663b2de46d2997346f973e98760eb95ae893
	604	 	464
File
Open

C:\ProgramData\RealNetworks\RealDownloader\Downloader\madatastore.dat
  MD5:  2a5c34227a08c0d1979539b2810aa152
  SHA1: d310663b2de46d2997346f973e98760eb95ae893
	604	 	464
File
Close

C:\ProgramData\System32\xfs
  MD5:  4fd5c02485a2269752bbc264f2563765
  SHA1: 69d438edd9d50432acaaa57a2779a88427714ce9
	604	 	3108
File
Hide

C:\ProgramData\System32\xfs
  MD5:  4fd5c02485a2269752bbc264f2563765
  SHA1: 69d438edd9d50432acaaa57a2779a88427714ce9
	604	 	3108
File
Close

C:\ProgramData\RealNetworks\RealDownloader\Downloader\madatastore.dat
  MD5:  77be20c155412a250a496ce69217c3fd
  SHA1: ca10edfaf3cf553166c1db1ff5d1831e01639999
	604	 	464
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\Downloader\madatastore.dat
New Name:   C:\ProgramData\RealNetworks\RealDownloader\Downloader\vARsbs6vUdVDw1NVEw7MkNNNSCDYGOUWYvlPPV1ZPEc=.7
   A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  77be20c155412a250a496ce69217c3fd
  SHA1: ca10edfaf3cf553166c1db1ff5d1831e01639999
	604	 	464
File
Open

C:\ProgramData\System32\xfs
  MD5:  4fd5c02485a2269752bbc264f2563765
  SHA1: 69d438edd9d50432acaaa57a2779a88427714ce9
	604	 	3108
File
Close

C:\ProgramData\System32\xfs
  MD5:  f1612e4d2ed195dbd4d1fb16e235fd6c
  SHA1: a0c62175588d5988da8dd780a13a7f68f5d1cd8f
	604	 	3292
File
Hide

C:\ProgramData\System32\xfs
  MD5:  f1612e4d2ed195dbd4d1fb16e235fd6c
  SHA1: a0c62175588d5988da8dd780a13a7f68f5d1cd8f
	604	 	3292
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Zune.xml
	604	 	6783
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Zune.xml
  MD5:  c184b54247e762e885cb1ebffa41fa4e
  SHA1: d8f7c6d3b071be3c3461cb9d74ded4c088f061ec
	604	 	7167
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Zune.xml
  MD5:  c184b54247e762e885cb1ebffa41fa4e
  SHA1: d8f7c6d3b071be3c3461cb9d74ded4c088f061ec
	604	 	7167
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Zune.xml
  MD5:  694b42cee7cceb3c033c0e6a6152b728
  SHA1: 8fec98d6b2f6b8416d73064fb1adc58d68d7382e
	604	 	7168
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Zune.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Yms2LC7ttj7D3RR+pa45+Q==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  694b42cee7cceb3c033c0e6a6152b728
  SHA1: 8fec98d6b2f6b8416d73064fb1adc58d68d7382e
	604	 	7168
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xbox360.xml
	604	 	6691
File
Open

C:\ProgramData\System32\xfs
  MD5:  f1612e4d2ed195dbd4d1fb16e235fd6c
  SHA1: a0c62175588d5988da8dd780a13a7f68f5d1cd8f
	604	 	3292
File
Close

C:\ProgramData\System32\xfs
  MD5:  088b3d2587573b18d49654409f5269d8
  SHA1: 5b7d647a6279cbab8fa085eb55fbaed7fbd34d9f
	604	 	3470
File
Hide

C:\ProgramData\System32\xfs
  MD5:  088b3d2587573b18d49654409f5269d8
  SHA1: 5b7d647a6279cbab8fa085eb55fbaed7fbd34d9f
	604	 	3470
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xbox360.xml
  MD5:  5be94aa15d27bd5c6d2d44dfd800808e
  SHA1: fc419c9b0af50ab3664b13f96fafd8cd11a298ad
	604	 	7075
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xbox360.xml
  MD5:  5be94aa15d27bd5c6d2d44dfd800808e
  SHA1: fc419c9b0af50ab3664b13f96fafd8cd11a298ad
	604	 	7075
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xbox360.xml
  MD5:  273ae25a20a9c161bd04f95d407966ff
  SHA1: e786377cddf92230676e9b58819357c766cdb990
	604	 	7088
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xbox360.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\lhtH9E-Z3zcCvX9fWVoxcXIB1b+hI5zsZSjTNvKe2j
   U=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  273ae25a20a9c161bd04f95d407966ff
  SHA1: e786377cddf92230676e9b58819357c766cdb990
	604	 	7088
File
Open

C:\ProgramData\System32\xfs
  MD5:  088b3d2587573b18d49654409f5269d8
  SHA1: 5b7d647a6279cbab8fa085eb55fbaed7fbd34d9f
	604	 	3470
File
Close

C:\ProgramData\System32\xfs
  MD5:  1108642c696e20c0ef5c60d41505216d
  SHA1: 31864df068aa180dff0d79eba38bb877fafda7fd
	604	 	3654
File
Hide

C:\ProgramData\System32\xfs
  MD5:  1108642c696e20c0ef5c60d41505216d
  SHA1: 31864df068aa180dff0d79eba38bb877fafda7fd
	604	 	3654
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\T-MobileG1.xml
	604	 	4649
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\T-MobileG1.xml
  MD5:  1a9a423a6ecfe4f81e830a2371df7cf3
  SHA1: 08e596a9583235e347b45185dc92e241b1e6a6f1
	604	 	5033
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\T-MobileG1.xml
  MD5:  1a9a423a6ecfe4f81e830a2371df7cf3
  SHA1: 08e596a9583235e347b45185dc92e241b1e6a6f1
	604	 	5033
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\T-MobileG1.xml
  MD5:  145fc2015bc840e07a1efac5ccc0b846
  SHA1: e6c8f81e25e5ebf316fca7cb78c6c5e233fa13bd
	604	 	5040
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\T-MobileG1.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\KSJA8NBynNjzop7lpo3ut8TML0b0mWFEdUs90KMdh1
   s=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  145fc2015bc840e07a1efac5ccc0b846
  SHA1: e6c8f81e25e5ebf316fca7cb78c6c5e233fa13bd
	604	 	5040
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SonyEricssonW760.xml
	604	 	5363
File
Open

C:\ProgramData\System32\xfs
  MD5:  1108642c696e20c0ef5c60d41505216d
  SHA1: 31864df068aa180dff0d79eba38bb877fafda7fd
	604	 	3654
File
Close

C:\ProgramData\System32\xfs
  MD5:  808401175319073e68d6cf269dfff305
  SHA1: 6d30278c69e379eab8fd25ece7186d2bee126c5f
	604	 	3844
File
Hide

C:\ProgramData\System32\xfs
  MD5:  808401175319073e68d6cf269dfff305
  SHA1: 6d30278c69e379eab8fd25ece7186d2bee126c5f
	604	 	3844
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SonyEricssonW760.xml
  MD5:  ea25ddae9cbfc44dee48ab4c094e92a6
  SHA1: 17c8acaf8efd005770b9e24d64d39623832214f8
	604	 	5747
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SonyEricssonW760.xml
  MD5:  ea25ddae9cbfc44dee48ab4c094e92a6
  SHA1: 17c8acaf8efd005770b9e24d64d39623832214f8
	604	 	5747
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SonyEricssonW760.xml
  MD5:  efb2876d81d1c067f11512549cffcc6e
  SHA1: 0412c57773f0a66c860cbc0ba7a6e15a6f4b45fe
	604	 	5760
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SonyEricssonW760.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\02imqzJMzhdtLtqkdBHUUKrRFdn16zvLyxuB5i4LOV
   oA3G1YkJs9ouhuLE+sjqXX.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  efb2876d81d1c067f11512549cffcc6e
  SHA1: 0412c57773f0a66c860cbc0ba7a6e15a6f4b45fe
	604	 	5760
File
Open

C:\ProgramData\System32\xfs
  MD5:  808401175319073e68d6cf269dfff305
  SHA1: 6d30278c69e379eab8fd25ece7186d2bee126c5f
	604	 	3844
File
Close

C:\ProgramData\System32\xfs
  MD5:  9ab60b58240e908524497674b4b541c8
  SHA1: 0747b2855ab4345075253c71ffd465ef618e3f38
	604	 	4046
File
Hide

C:\ProgramData\System32\xfs
  MD5:  9ab60b58240e908524497674b4b541c8
  SHA1: 0747b2855ab4345075253c71ffd465ef618e3f38
	604	 	4046
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Sidekick.xml
	604	 	4014
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Sidekick.xml
  MD5:  387ba605bda41d97ff79dc82d437095f
  SHA1: 7179f123148025273b93826d3362782deddc0788
	604	 	4398
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Sidekick.xml
  MD5:  387ba605bda41d97ff79dc82d437095f
  SHA1: 7179f123148025273b93826d3362782deddc0788
	604	 	4398
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Sidekick.xml
  MD5:  fa2e7e1279155e7667a7530092cf86a0
  SHA1: 6a255067887d856ec8e7154e183a8d8640c0c522
	604	 	4400
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Sidekick.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\uninQwZmvkMwO8A8L4h-c+Q-Rw9QGP2HqclnC+uHHV
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  fa2e7e1279155e7667a7530092cf86a0
  SHA1: 6a255067887d856ec8e7154e183a8d8640c0c522
	604	 	4400
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMoment.xml
	604	 	7105
File
Open

C:\ProgramData\System32\xfs
  MD5:  9ab60b58240e908524497674b4b541c8
  SHA1: 0747b2855ab4345075253c71ffd465ef618e3f38
	604	 	4046
File
Close

C:\ProgramData\System32\xfs
  MD5:  51229eaef48abc70e448fbeea34076b5
  SHA1: 1aa762f1c13a735573968dc6487c024e9ed658ef
	604	 	4232
File
Hide

C:\ProgramData\System32\xfs
  MD5:  51229eaef48abc70e448fbeea34076b5
  SHA1: 1aa762f1c13a735573968dc6487c024e9ed658ef
	604	 	4232
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMoment.xml
  MD5:  4d279b826e54a73726b5d9fbb8df7888
  SHA1: 42ab163c3e8234203a8dcc54bfc2b85b4f469f79
	604	 	7489
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMoment.xml
  MD5:  4d279b826e54a73726b5d9fbb8df7888
  SHA1: 42ab163c3e8234203a8dcc54bfc2b85b4f469f79
	604	 	7489
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMoment.xml
  MD5:  2ea94923c9e3df1d2c39f25469d3602f
  SHA1: 49358c1987aa7f4f58151938cf1f6bd3765c8d5d
	604	 	7504
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMoment.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\exkuUO7i5KEr5Y3HiFe3Tw0WAJK9y9uMqff6AwrPuE
   +zdVR8rA+pf86L6n2TPRmq.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  2ea94923c9e3df1d2c39f25469d3602f
  SHA1: 49358c1987aa7f4f58151938cf1f6bd3765c8d5d
	604	 	7504
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMemoir.xml
	604	 	5458
File
Open

C:\ProgramData\System32\xfs
  MD5:  51229eaef48abc70e448fbeea34076b5
  SHA1: 1aa762f1c13a735573968dc6487c024e9ed658ef
	604	 	4232
File
Close

C:\ProgramData\System32\xfs
  MD5:  73996aa8e26096f4cc1483ca84028531
  SHA1: 0c10264059ee938303937982abd0338ebb3c3671
	604	 	4428
File
Hide

C:\ProgramData\System32\xfs
  MD5:  73996aa8e26096f4cc1483ca84028531
  SHA1: 0c10264059ee938303937982abd0338ebb3c3671
	604	 	4428
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMemoir.xml
  MD5:  240d2245dcd494f5d6fb5fc8da67f1a6
  SHA1: 09dabe48ea2155c85b46016c5cf8efccb8dae39d
	604	 	5842
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMemoir.xml
  MD5:  240d2245dcd494f5d6fb5fc8da67f1a6
  SHA1: 09dabe48ea2155c85b46016c5cf8efccb8dae39d
	604	 	5842
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMemoir.xml
  MD5:  5ea0553c92edf8510769d036fff1759a
  SHA1: 6bee3ed7e2bb5e74bcbb6795af7f60cc78713783
	604	 	5856
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungMemoir.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\0FhNN0+4a7HQlHd82oMsdwGQ2or3MsmZdaJ6U6ubTu
   6oFvmrSofqF+zoc7VmnkuV.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  5ea0553c92edf8510769d036fff1759a
  SHA1: 6bee3ed7e2bb5e74bcbb6795af7f60cc78713783
	604	 	5856
File
Open

C:\ProgramData\System32\xfs
  MD5:  73996aa8e26096f4cc1483ca84028531
  SHA1: 0c10264059ee938303937982abd0338ebb3c3671
	604	 	4428
File
Close

C:\ProgramData\System32\xfs
  MD5:  8371abd406c44d480e2381fc98b089d3
  SHA1: 9c6098a35f9dd90379df3ab618172e5bc0e24873
	604	 	4624
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungJack.xml
	604	 	6033
File
Hide

C:\ProgramData\System32\xfs
  MD5:  8371abd406c44d480e2381fc98b089d3
  SHA1: 9c6098a35f9dd90379df3ab618172e5bc0e24873
	604	 	4624
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungJack.xml
  MD5:  75eaa5e6d3485132d3246184e042f8f8
  SHA1: b67eafe273faef4899f95abc6b6de9a662528be6
	604	 	6417
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungJack.xml
  MD5:  75eaa5e6d3485132d3246184e042f8f8
  SHA1: b67eafe273faef4899f95abc6b6de9a662528be6
	604	 	6417
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungJack.xml
  MD5:  af133ce0dd7d1bab614fb4ed16e0fc9c
  SHA1: 05b721cf2dbc26ea6f3556cdfdddda0cf79cf18e
	604	 	6432
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungJack.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NgcaHL0pivRAgpFzavanafFxCnQer4R31jAyJZTTIn
   Q=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  af133ce0dd7d1bab614fb4ed16e0fc9c
  SHA1: 05b721cf2dbc26ea6f3556cdfdddda0cf79cf18e
	604	 	6432
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS3.xml
	604	 	9171
File
Open

C:\ProgramData\System32\xfs
  MD5:  8371abd406c44d480e2381fc98b089d3
  SHA1: 9c6098a35f9dd90379df3ab618172e5bc0e24873
	604	 	4624
File
Close

C:\ProgramData\System32\xfs
  MD5:  f2ac000a81aa51bc5d48674a30a4f1e0
  SHA1: 3f241b98cf33675d97c50615d1671940ec28e60d
	604	 	4816
File
Hide

C:\ProgramData\System32\xfs
  MD5:  f2ac000a81aa51bc5d48674a30a4f1e0
  SHA1: 3f241b98cf33675d97c50615d1671940ec28e60d
	604	 	4816
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS3.xml
  MD5:  2d00bddb3a54e51e000065f2d8ebaddf
  SHA1: 35264efacba25d061b3864cdecfaf18b450ce0ce
	604	 	9555
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS3.xml
  MD5:  2d00bddb3a54e51e000065f2d8ebaddf
  SHA1: 35264efacba25d061b3864cdecfaf18b450ce0ce
	604	 	9555
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS3.xml
  MD5:  1cf144adac94cd537b47ee4f21dd10d6
  SHA1: f1cf3fec6341874c5896d9d63a84f7c6cb97bfc5
	604	 	9568
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS3.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\oupMqDzQmWdjlHlZ6TG+YuKeqrFOGJf4hNcwrq3y6H
   8TtYV8hLU5KWpQS7-jd-jQ.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  1cf144adac94cd537b47ee4f21dd10d6
  SHA1: f1cf3fec6341874c5896d9d63a84f7c6cb97bfc5
	604	 	9568
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS2.xml
	604	 	9459
File
Open

C:\ProgramData\System32\xfs
  MD5:  f2ac000a81aa51bc5d48674a30a4f1e0
  SHA1: 3f241b98cf33675d97c50615d1671940ec28e60d
	604	 	4816
File
Close

C:\ProgramData\System32\xfs
  MD5:  63c80283c4e2f69c8a70a5f9e8ab395f
  SHA1: bbb0fb6287db67eed652409a40df563edb241c24
	604	 	5016
File
Hide

C:\ProgramData\System32\xfs
  MD5:  63c80283c4e2f69c8a70a5f9e8ab395f
  SHA1: bbb0fb6287db67eed652409a40df563edb241c24
	604	 	5016
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS2.xml
  MD5:  d4dc9df19bcb162fe81194e9d5ad3a33
  SHA1: 6eca36042a9eccef37b9d0db15550377b40243b8
	604	 	9843
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS2.xml
  MD5:  d4dc9df19bcb162fe81194e9d5ad3a33
  SHA1: 6eca36042a9eccef37b9d0db15550377b40243b8
	604	 	9843
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS2.xml
  MD5:  bf42aecd830042694bb57d15e42a6aef
  SHA1: 5e6f30b3f7688358a59ba0d944680fea3740499a
	604	 	9856
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyS2.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\H46UnhdE0tMJ8VOrybgp48X6NDRw2DQTU46EF99Ms1
   sNoeWyNhSBLmvZLa83PmAV.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  bf42aecd830042694bb57d15e42a6aef
  SHA1: 5e6f30b3f7688358a59ba0d944680fea3740499a
	604	 	9856
File
Open

C:\ProgramData\System32\xfs
  MD5:  63c80283c4e2f69c8a70a5f9e8ab395f
  SHA1: bbb0fb6287db67eed652409a40df563edb241c24
	604	 	5016
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyNote.xml
	604	 	9148
File
Close

C:\ProgramData\System32\xfs
  MD5:  d23451717faef006838316174ef64585
  SHA1: f15e966f3e6ee81bedbc4d045060640becc2ecc7
	604	 	5216
File
Hide

C:\ProgramData\System32\xfs
  MD5:  d23451717faef006838316174ef64585
  SHA1: f15e966f3e6ee81bedbc4d045060640becc2ecc7
	604	 	5216
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyNote.xml
  MD5:  baac8853d55a81b675a91babc6e30e12
  SHA1: ef93db41dab7bca35fa3b602f6c06be9efc81c4c
	604	 	9532
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyNote.xml
  MD5:  baac8853d55a81b675a91babc6e30e12
  SHA1: ef93db41dab7bca35fa3b602f6c06be9efc81c4c
	604	 	9532
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyNote.xml
  MD5:  6a3ab23d1631917486509bf382236df8
  SHA1: 2b0cde1c97178151c690d406f38cb2ce26e113eb
	604	 	9536
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungGalaxyNote.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\qq9O1JbBBBi477CMcrMndJT08n4RkwqJrJUCm7jCHs
   V4yowBrvobSRgaTHqvJtBi.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  6a3ab23d1631917486509bf382236df8
  SHA1: 2b0cde1c97178151c690d406f38cb2ce26e113eb
	604	 	9536
File
Open

C:\ProgramData\System32\xfs
  MD5:  d23451717faef006838316174ef64585
  SHA1: f15e966f3e6ee81bedbc4d045060640becc2ecc7
	604	 	5216
File
Close

C:\ProgramData\System32\xfs
  MD5:  8541dcaf4a469f6f6a3bc60a77dc1374
  SHA1: c8723053425af261fbef70151fbb6841d3580faa
	604	 	5420
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungEternity.xml
	604	 	6520
File
Hide

C:\ProgramData\System32\xfs
  MD5:  8541dcaf4a469f6f6a3bc60a77dc1374
  SHA1: c8723053425af261fbef70151fbb6841d3580faa
	604	 	5420
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungEternity.xml
  MD5:  9f891b8321615ba959ccef8720eb0e73
  SHA1: 0ac22f087d75b1332cf3fbdba8266c3e45825092
	604	 	6904
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungEternity.xml
  MD5:  9f891b8321615ba959ccef8720eb0e73
  SHA1: 0ac22f087d75b1332cf3fbdba8266c3e45825092
	604	 	6904
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungEternity.xml
  MD5:  f0fd7dfaeb600ddeb3272092e8485ade
  SHA1: 13a19b7135d899b5407d95f44f21d8b1246771ae
	604	 	6912
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungEternity.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\f6l1wLbDDtkSyWk+7jVhLan3rgCgD98dlFE+3z9oI6
   ut+QMa2-g-efQH+FJcC5WT.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  f0fd7dfaeb600ddeb3272092e8485ade
  SHA1: 13a19b7135d899b5407d95f44f21d8b1246771ae
	604	 	6912
File
Open

C:\ProgramData\System32\xfs
  MD5:  8541dcaf4a469f6f6a3bc60a77dc1374
  SHA1: c8723053425af261fbef70151fbb6841d3580faa
	604	 	5420
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungBeholdII.xml
	604	 	5164
File
Close

C:\ProgramData\System32\xfs
  MD5:  72464befa235d477254864a3078174ea
  SHA1: 6213b1233bab057d23ef7b78b1f43c7855df9a21
	604	 	5620
File
Hide

C:\ProgramData\System32\xfs
  MD5:  72464befa235d477254864a3078174ea
  SHA1: 6213b1233bab057d23ef7b78b1f43c7855df9a21
	604	 	5620
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungBeholdII.xml
  MD5:  2bee511cffad099ab400d42afcd1c53e
  SHA1: f90ad767bd205b099f08c79640d1e815a74293ee
	604	 	5548
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungBeholdII.xml
  MD5:  2bee511cffad099ab400d42afcd1c53e
  SHA1: f90ad767bd205b099f08c79640d1e815a74293ee
	604	 	5548
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungBeholdII.xml
  MD5:  7fbd801070f1f60ca4e42a6ffd06dbcd
  SHA1: 26a46620bf2c29e94584d5ae565dea6c2560ff0b
	604	 	5552
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SamsungBeholdII.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\x5bCKfHJlECvbho1SRjDUX5bUm+g1BExr0WncGPIBj
   tCe9Whr4Jsop6XtF9HQvBv.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  7fbd801070f1f60ca4e42a6ffd06dbcd
  SHA1: 26a46620bf2c29e94584d5ae565dea6c2560ff0b
	604	 	5552
File
Open

C:\ProgramData\System32\xfs
  MD5:  72464befa235d477254864a3078174ea
  SHA1: 6213b1233bab057d23ef7b78b1f43c7855df9a21
	604	 	5620
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Samsung.xml
	604	 	6497
File
Close

C:\ProgramData\System32\xfs
  MD5:  d55fdaddead04ef4b8126cb90431dffa
  SHA1: a2eb62311b84e2aa05d2157562a934328aacb650
	604	 	5820
File
Hide

C:\ProgramData\System32\xfs
  MD5:  d55fdaddead04ef4b8126cb90431dffa
  SHA1: a2eb62311b84e2aa05d2157562a934328aacb650
	604	 	5820
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Samsung.xml
  MD5:  b43a4c62b3978cb863cbc586fff2ca07
  SHA1: 15ba48fc91de2ebd10e71c999c7f72c9b339dc03
	604	 	6881
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Samsung.xml
  MD5:  b43a4c62b3978cb863cbc586fff2ca07
  SHA1: 15ba48fc91de2ebd10e71c999c7f72c9b339dc03
	604	 	6881
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Samsung.xml
  MD5:  70721dd35b4cc705d1d01d9a741b97ab
  SHA1: 8392432d4985e2ac259f8e2d4f41552821c4c999
	604	 	6896
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Samsung.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\vQPhHe23jv4OrMOzOnLSUGP6ZBVmGKon9GD1pB080G
   o=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  70721dd35b4cc705d1d01d9a741b97ab
  SHA1: 8392432d4985e2ac259f8e2d4f41552821c4c999
	604	 	6896
File
Open

C:\ProgramData\System32\xfs
  MD5:  d55fdaddead04ef4b8126cb90431dffa
  SHA1: a2eb62311b84e2aa05d2157562a934328aacb650
	604	 	5820
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PSP.xml
	604	 	4818
File
Close

C:\ProgramData\System32\xfs
  MD5:  f40c6f323dda67468533dac61b7fd4ca
  SHA1: d385e46a489e1e8c074d809c8836da960cf41620
	604	 	6004
File
Hide

C:\ProgramData\System32\xfs
  MD5:  f40c6f323dda67468533dac61b7fd4ca
  SHA1: d385e46a489e1e8c074d809c8836da960cf41620
	604	 	6004
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PSP.xml
  MD5:  a04f7ac6ddac2afaffe33cfc93ebb7aa
  SHA1: 18b8721ba03e848e9f9f8331230a2ecfebbfa857
	604	 	5202
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PSP.xml
  MD5:  a04f7ac6ddac2afaffe33cfc93ebb7aa
  SHA1: 18b8721ba03e848e9f9f8331230a2ecfebbfa857
	604	 	5202
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PSP.xml
  MD5:  8acf1f77304c16700ac42eee28991732
  SHA1: 66d619ca8f970cd3e669147d2aa9cc4c6bebf3df
	604	 	5216
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PSP.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\UQiEmkNdPK+Y7yTLeh5GHA==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  8acf1f77304c16700ac42eee28991732
  SHA1: 66d619ca8f970cd3e669147d2aa9cc4c6bebf3df
	604	 	5216
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PlayStation3.xml
	604	 	6708
File
Open

C:\ProgramData\System32\xfs
  MD5:  f40c6f323dda67468533dac61b7fd4ca
  SHA1: d385e46a489e1e8c074d809c8836da960cf41620
	604	 	6004
File
Close

C:\ProgramData\System32\xfs
  MD5:  c1169d8afe6832b1038374ff7eb154ec
  SHA1: 6ea322769ba990412d9e4aaf945533b58958e494
	604	 	6180
File
Hide

C:\ProgramData\System32\xfs
  MD5:  c1169d8afe6832b1038374ff7eb154ec
  SHA1: 6ea322769ba990412d9e4aaf945533b58958e494
	604	 	6180
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PlayStation3.xml
  MD5:  9b59c2caadfd97c3091240952f84fbac
  SHA1: c269fbbca452fdcdcbc94d4335a558bfa934b242
	604	 	7092
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PlayStation3.xml
  MD5:  9b59c2caadfd97c3091240952f84fbac
  SHA1: c269fbbca452fdcdcbc94d4335a558bfa934b242
	604	 	7092
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PlayStation3.xml
  MD5:  ef43c1c7263ba6927a55e9fd7f799200
  SHA1: 2b5b589dec02ef09d3362568368292f6f776ab14
	604	 	7104
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PlayStation3.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\XKJA+KWgahf1pps-wS-VsEMJLs3jJjuDBcs4mgBexP
   k=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ef43c1c7263ba6927a55e9fd7f799200
  SHA1: 2b5b589dec02ef09d3362568368292f6f776ab14
	604	 	7104
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PCorMac.xml
	604	 	9992
File
Open

C:\ProgramData\System32\xfs
  MD5:  c1169d8afe6832b1038374ff7eb154ec
  SHA1: 6ea322769ba990412d9e4aaf945533b58958e494
	604	 	6180
File
Close

C:\ProgramData\System32\xfs
  MD5:  52605d341648947ba3d2e3138050a5bc
  SHA1: c82d5d8939d862a2c1d417dff074655e83f0f78d
	604	 	6374
File
Hide

C:\ProgramData\System32\xfs
  MD5:  52605d341648947ba3d2e3138050a5bc
  SHA1: c82d5d8939d862a2c1d417dff074655e83f0f78d
	604	 	6374
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PCorMac.xml
  MD5:  14e93db48a76535d4f4555125c75b998
  SHA1: 05f7325e041e17ef58d0f71c0a0d0055087ab534
	604	 	10376
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PCorMac.xml
  MD5:  14e93db48a76535d4f4555125c75b998
  SHA1: 05f7325e041e17ef58d0f71c0a0d0055087ab534
	604	 	10376
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PCorMac.xml
  MD5:  55334f6dfb6a6158621624df2217a811
  SHA1: f5906e0291e9d60a2e2170b3e146f4d1727e736a
	604	 	10384
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PCorMac.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Hfh9x-CSbyN6PMY6UWRb7hBZVray8M+sKd4hBen+vy
   w=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  55334f6dfb6a6158621624df2217a811
  SHA1: f5906e0291e9d60a2e2170b3e146f4d1727e736a
	604	 	10384
File
Open

C:\ProgramData\System32\xfs
  MD5:  52605d341648947ba3d2e3138050a5bc
  SHA1: c82d5d8939d862a2c1d417dff074655e83f0f78d
	604	 	6374
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmPre.xml
	604	 	5441
File
Close

C:\ProgramData\System32\xfs
  MD5:  31371f9d1d0353e7662912edccbb2ab5
  SHA1: 16eab066d51c8576938529d7a25ab7c7173a13f0
	604	 	6558
File
Hide

C:\ProgramData\System32\xfs
  MD5:  31371f9d1d0353e7662912edccbb2ab5
  SHA1: 16eab066d51c8576938529d7a25ab7c7173a13f0
	604	 	6558
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmPre.xml
  MD5:  05ed9317068f6637695e1a8134f11245
  SHA1: 12fd77d03997a9c9d1053b9fa40656320a11d125
	604	 	5825
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmPre.xml
  MD5:  05ed9317068f6637695e1a8134f11245
  SHA1: 12fd77d03997a9c9d1053b9fa40656320a11d125
	604	 	5825
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmPre.xml
  MD5:  983d060830be5f091c4e6d79f8ec1332
  SHA1: f8c74b16cdfccbe5a6091660f53bf54c8c93b2c0
	604	 	5840
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmPre.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\4lro6UrnZnAnolbzLAkyFW1ppECWPHwwcDV2O3wYYE
   U=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  983d060830be5f091c4e6d79f8ec1332
  SHA1: f8c74b16cdfccbe5a6091660f53bf54c8c93b2c0
	604	 	5840
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmCentro.xml
	604	 	2672
File
Open

C:\ProgramData\System32\xfs
  MD5:  31371f9d1d0353e7662912edccbb2ab5
  SHA1: 16eab066d51c8576938529d7a25ab7c7173a13f0
	604	 	6558
File
Close

C:\ProgramData\System32\xfs
  MD5:  6fda7aaae38bbe8b64e7f6b6df0d9f0e
  SHA1: 11e23cc41846a68218671813adefee86fd73de53
	604	 	6742
File
Hide

C:\ProgramData\System32\xfs
  MD5:  6fda7aaae38bbe8b64e7f6b6df0d9f0e
  SHA1: 11e23cc41846a68218671813adefee86fd73de53
	604	 	6742
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmCentro.xml
  MD5:  992326804b1f5642c19dde09dafd6c6a
  SHA1: 3f3ca523cc7ed06e9d8b86ee7fe0fcee394ff460
	604	 	3056
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmCentro.xml
  MD5:  992326804b1f5642c19dde09dafd6c6a
  SHA1: 3f3ca523cc7ed06e9d8b86ee7fe0fcee394ff460
	604	 	3056
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmCentro.xml
  MD5:  71a23bca50f9c9b1468cca933c53ff69
  SHA1: f312cf35a0a210a07e303d5b180af363686ec854
	604	 	3056
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\PalmCentro.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\ZvqgyWIl0jbUDuzksy+jC178cqCOsqdRf2u2Xosl0d
   o=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  71a23bca50f9c9b1468cca933c53ff69
  SHA1: f312cf35a0a210a07e303d5b180af363686ec854
	604	 	3056
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokian97.xml
	604	 	6216
File
Open

C:\ProgramData\System32\xfs
  MD5:  6fda7aaae38bbe8b64e7f6b6df0d9f0e
  SHA1: 11e23cc41846a68218671813adefee86fd73de53
	604	 	6742
File
Close

C:\ProgramData\System32\xfs
  MD5:  61b66310b775141e5c44def55fa3bd63
  SHA1: 92bacef09b0b05f531b6a544b70f0734fbebbada
	604	 	6932
File
Hide

C:\ProgramData\System32\xfs
  MD5:  61b66310b775141e5c44def55fa3bd63
  SHA1: 92bacef09b0b05f531b6a544b70f0734fbebbada
	604	 	6932
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokian97.xml
  MD5:  70d583231166467f51569c2ca697cf90
  SHA1: 1ec8052ee2f507fb96b14c5cafcb742fd918ffde
	604	 	6600
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokian97.xml
  MD5:  70d583231166467f51569c2ca697cf90
  SHA1: 1ec8052ee2f507fb96b14c5cafcb742fd918ffde
	604	 	6600
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokian97.xml
  MD5:  80681a7e343adba3a1f4d3b6bb2159a3
  SHA1: 42898e7d024b0f07d0655e5b625aaac18893efb3
	604	 	6608
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokian97.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\J3NeZOq40KJ8nvVvWQQi7xczlGOlh87oOIDZIiQBN+
   A=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  80681a7e343adba3a1f4d3b6bb2159a3
  SHA1: 42898e7d024b0f07d0655e5b625aaac18893efb3
	604	 	6608
File
Open

C:\ProgramData\System32\xfs
  MD5:  61b66310b775141e5c44def55fa3bd63
  SHA1: 92bacef09b0b05f531b6a544b70f0734fbebbada
	604	 	6932
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaN95.xml
	604	 	5389
File
Close

C:\ProgramData\System32\xfs
  MD5:  5551c6cc065fccda0537c8a860242366
  SHA1: 2575aad811581133d9c0115feb443162b5cebf89
	604	 	7118
File
Hide

C:\ProgramData\System32\xfs
  MD5:  5551c6cc065fccda0537c8a860242366
  SHA1: 2575aad811581133d9c0115feb443162b5cebf89
	604	 	7118
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaN95.xml
  MD5:  3efa2599b89557034df7bbc2ad67334e
  SHA1: 383d3cefa1b40503f571f0f74b258b53f3c7f5d8
	604	 	5773
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaN95.xml
  MD5:  3efa2599b89557034df7bbc2ad67334e
  SHA1: 383d3cefa1b40503f571f0f74b258b53f3c7f5d8
	604	 	5773
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaN95.xml
  MD5:  57a03d4dcbbbc3f58f1d3ee1f8cd54d3
  SHA1: 3a86aba5a2f5367c3dde4bc5d8e426130796db2e
	604	 	5776
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaN95.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\VQRd7A5-N889jdlL5b-UsjKEivUNG+75wk7ro12yJR
   E=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  57a03d4dcbbbc3f58f1d3ee1f8cd54d3
  SHA1: 3a86aba5a2f5367c3dde4bc5d8e426130796db2e
	604	 	5776
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE75.xml
	604	 	7451
File
Open

C:\ProgramData\System32\xfs
  MD5:  5551c6cc065fccda0537c8a860242366
  SHA1: 2575aad811581133d9c0115feb443162b5cebf89
	604	 	7118
File
Close

C:\ProgramData\System32\xfs
  MD5:  0b5d08b76fad8990e73062bd427fb693
  SHA1: fab075c476382fd9b3c6b99b781d0a136654b9d5
	604	 	7304
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0b5d08b76fad8990e73062bd427fb693
  SHA1: fab075c476382fd9b3c6b99b781d0a136654b9d5
	604	 	7304
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE75.xml
  MD5:  ee3531a4b09d601575a15c58d57e847d
  SHA1: 6f3d39554a4b3c31819229580011af7791b5a23a
	604	 	7835
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE75.xml
  MD5:  ee3531a4b09d601575a15c58d57e847d
  SHA1: 6f3d39554a4b3c31819229580011af7791b5a23a
	604	 	7835
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE75.xml
  MD5:  63558ee89b3508b372606ab11effaebf
  SHA1: be8dc13503d20303e48eb2fb170e09fe5436d41e
	604	 	7840
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE75.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\vWysMuTWJbzvctFwpl6+zCRi09aOdgrTBJM--4WXeB
   g=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  63558ee89b3508b372606ab11effaebf
  SHA1: be8dc13503d20303e48eb2fb170e09fe5436d41e
	604	 	7840
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE71x.xml
	604	 	7599
File
Open

C:\ProgramData\System32\xfs
  MD5:  0b5d08b76fad8990e73062bd427fb693
  SHA1: fab075c476382fd9b3c6b99b781d0a136654b9d5
	604	 	7304
File
Close

C:\ProgramData\System32\xfs
  MD5:  fb2602b04538bb74ee0edb7fb82befff
  SHA1: 1a21f5a736e68a1fd6c9c27d8c3ecf39899578be
	604	 	7490
File
Hide

C:\ProgramData\System32\xfs
  MD5:  fb2602b04538bb74ee0edb7fb82befff
  SHA1: 1a21f5a736e68a1fd6c9c27d8c3ecf39899578be
	604	 	7490
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE71x.xml
  MD5:  cf5956d9173416127b75e7859311fa93
  SHA1: 7ddea280e53186cfaa5ebf8282fb89edf3dcf25a
	604	 	7983
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE71x.xml
  MD5:  cf5956d9173416127b75e7859311fa93
  SHA1: 7ddea280e53186cfaa5ebf8282fb89edf3dcf25a
	604	 	7983
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE71x.xml
  MD5:  df00bbb3b1705409a6d8e40b4315f50a
  SHA1: d532c8f623db5e9bd4d10644958c9f214ad6e0ff
	604	 	7984
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\NokiaE71x.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\6OGLSO+0aLf9EnQBb4D-bz7VDRX18DOVoKrxRJt13q
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  df00bbb3b1705409a6d8e40b4315f50a
  SHA1: d532c8f623db5e9bd4d10644958c9f214ad6e0ff
	604	 	7984
File
Open

C:\ProgramData\System32\xfs
  MD5:  fb2602b04538bb74ee0edb7fb82befff
  SHA1: 1a21f5a736e68a1fd6c9c27d8c3ecf39899578be
	604	 	7490
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokia5800XpressMusic.xml
	604	 	8189
File
Close

C:\ProgramData\System32\xfs
  MD5:  21fddc5464b0295dfa63b2dfa4d77e08
  SHA1: 47ed35901f0c34ab1b77de9500c7fb17b20159d3
	604	 	7678
File
Hide

C:\ProgramData\System32\xfs
  MD5:  21fddc5464b0295dfa63b2dfa4d77e08
  SHA1: 47ed35901f0c34ab1b77de9500c7fb17b20159d3
	604	 	7678
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokia5800XpressMusic.xml
  MD5:  4c1b35fb30da2f2ccf631c03159609e5
  SHA1: 091318cf8b671ee293a7f7e57af2222e7c0d6435
	604	 	8573
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokia5800XpressMusic.xml
  MD5:  4c1b35fb30da2f2ccf631c03159609e5
  SHA1: 091318cf8b671ee293a7f7e57af2222e7c0d6435
	604	 	8573
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokia5800XpressMusic.xml
  MD5:  03758ad4f7ae03bab6f7a58264806d45
  SHA1: 2cda2168df20b9ade0defbd25997b0a0b5cc260c
	604	 	8576
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Nokia5800XpressMusic.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\SCFUImbeQrm+a5tgEqrF99mfDvYTOEjO5F4WcFT99h
   y2z2a560QCkD4Lsc+-Binn.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  03758ad4f7ae03bab6f7a58264806d45
  SHA1: 2cda2168df20b9ade0defbd25997b0a0b5cc260c
	604	 	8576
File
Open

C:\ProgramData\System32\xfs
  MD5:  21fddc5464b0295dfa63b2dfa4d77e08
  SHA1: 47ed35901f0c34ab1b77de9500c7fb17b20159d3
	604	 	7678
File
Close

C:\ProgramData\System32\xfs
  MD5:  c5cd55f5e0bf6586e2c2251ed0cf5a66
  SHA1: aa5e5e0146efb4388a922bf81c11b419b7d898c3
	604	 	7888
File
Hide

C:\ProgramData\System32\xfs
  MD5:  c5cd55f5e0bf6586e2c2251ed0cf5a66
  SHA1: aa5e5e0146efb4388a922bf81c11b419b7d898c3
	604	 	7888
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MP3Player.xml
	604	 	1506
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MP3Player.xml
  MD5:  dd02db100c5cbcd05e0c8f79deeb7ab6
  SHA1: 5dd1d1d52b96ba1a540c7d1fdcfd566116fddd21
	604	 	1890
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MP3Player.xml
  MD5:  dd02db100c5cbcd05e0c8f79deeb7ab6
  SHA1: 5dd1d1d52b96ba1a540c7d1fdcfd566116fddd21
	604	 	1890
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MP3Player.xml
  MD5:  96892e8263a4b83463c220fe258d9970
  SHA1: 10f3f7055b112d35df88c6a42656a3d1dd0b60a7
	604	 	1904
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MP3Player.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\WOJO7bg0rG+2Jo-WKilSxJu1ixDOmczYcC1F+FfTmn
   c=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  96892e8263a4b83463c220fe258d9970
  SHA1: 10f3f7055b112d35df88c6a42656a3d1dd0b60a7
	604	 	1904
File
Open

C:\ProgramData\System32\xfs
  MD5:  c5cd55f5e0bf6586e2c2251ed0cf5a66
  SHA1: aa5e5e0146efb4388a922bf81c11b419b7d898c3
	604	 	7888
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaDroid.xml
	604	 	7496
File
Close

C:\ProgramData\System32\xfs
  MD5:  697e93e5eaeaa57e2a63c520a9793547
  SHA1: 55093fadc2f474dfb2bb2c01ccd58d38d9eeeb98
	604	 	8076
File
Hide

C:\ProgramData\System32\xfs
  MD5:  697e93e5eaeaa57e2a63c520a9793547
  SHA1: 55093fadc2f474dfb2bb2c01ccd58d38d9eeeb98
	604	 	8076
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaDroid.xml
  MD5:  7ec43407a43f6ece0f8441c51d06c0bb
  SHA1: c590787ce7dd0ab9a4c922e89768ed3c3f6ae4b9
	604	 	7880
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaDroid.xml
  MD5:  7ec43407a43f6ece0f8441c51d06c0bb
  SHA1: c590787ce7dd0ab9a4c922e89768ed3c3f6ae4b9
	604	 	7880
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaDroid.xml
  MD5:  3eb8c3db15394c3cdbe955455724eddd
  SHA1: cc3f522032664a8b7f3e4ff6558806c551ff918c
	604	 	7888
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaDroid.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\JF4ZghmFRm5bgQhs5qv4jBYsHN8ONp55kSxrcUlPFg
   210-Q-ZWMKpRP+8K4q-U54.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  3eb8c3db15394c3cdbe955455724eddd
  SHA1: cc3f522032664a8b7f3e4ff6558806c551ff918c
	604	 	7888
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaCliq.xml
	604	 	6183
File
Open

C:\ProgramData\System32\xfs
  MD5:  697e93e5eaeaa57e2a63c520a9793547
  SHA1: 55093fadc2f474dfb2bb2c01ccd58d38d9eeeb98
	604	 	8076
File
Close

C:\ProgramData\System32\xfs
  MD5:  10a6bd4631820dc149fc442007dbbfc5
  SHA1: aa7c4579f1ca52ba0750c16cb7fb9013bfa20dfb
	604	 	8272
File
Hide

C:\ProgramData\System32\xfs
  MD5:  10a6bd4631820dc149fc442007dbbfc5
  SHA1: aa7c4579f1ca52ba0750c16cb7fb9013bfa20dfb
	604	 	8272
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaCliq.xml
  MD5:  e56804a04b35ff509717af7f75eebe33
  SHA1: e1fde1b10744bd2b3896233eda33288d879e8128
	604	 	6567
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaCliq.xml
  MD5:  e56804a04b35ff509717af7f75eebe33
  SHA1: e1fde1b10744bd2b3896233eda33288d879e8128
	604	 	6567
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaCliq.xml
  MD5:  93d216fe0ffa0ef57d1c3b7eab1325ae
  SHA1: 94dd761e6867496c7f7d0d77bb4db6fbee062336
	604	 	6576
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaCliq.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\-OUJMJbiqB1OlpA5vP+HG2UuAyVqp6+bjKfa2tx3-q
   I=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  93d216fe0ffa0ef57d1c3b7eab1325ae
  SHA1: 94dd761e6867496c7f7d0d77bb4db6fbee062336
	604	 	6576
File
Open

C:\ProgramData\System32\xfs
  MD5:  10a6bd4631820dc149fc442007dbbfc5
  SHA1: aa7c4579f1ca52ba0750c16cb7fb9013bfa20dfb
	604	 	8272
File
Close

C:\ProgramData\System32\xfs
  MD5:  c0e1a339edd36fc67cd43d6a086b6534
  SHA1: 84aca458ae2189ed3cd71fe9ab0f109cc990dbfc
	604	 	8466
File
Hide

C:\ProgramData\System32\xfs
  MD5:  c0e1a339edd36fc67cd43d6a086b6534
  SHA1: 84aca458ae2189ed3cd71fe9ab0f109cc990dbfc
	604	 	8466
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaBackflip.xml
	604	 	5800
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaBackflip.xml
  MD5:  f01d6ebe9626aa9963df89d1e13af284
  SHA1: 57bc62dee26d11c6855b0bb273077ea7af122b86
	604	 	6184
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaBackflip.xml
  MD5:  f01d6ebe9626aa9963df89d1e13af284
  SHA1: 57bc62dee26d11c6855b0bb273077ea7af122b86
	604	 	6184
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaBackflip.xml
  MD5:  8fcdc7a38dd19344caefebd702ebd6c9
  SHA1: d2ec0685b3370c6cf4b2c7aaa5960d2c51a47555
	604	 	6192
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\MotorolaBackflip.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\sXqt18Ul5tHMofWOcldXtkL8QXT+S0PEFQ4NhjRuI-
   nWH5Wz4mgBUcv5B2F4iFm9.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  8fcdc7a38dd19344caefebd702ebd6c9
  SHA1: d2ec0685b3370c6cf4b2c7aaa5960d2c51a47555
	604	 	6192
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Motorola.xml
	604	 	5951
File
Open

C:\ProgramData\System32\xfs
  MD5:  c0e1a339edd36fc67cd43d6a086b6534
  SHA1: 84aca458ae2189ed3cd71fe9ab0f109cc990dbfc
	604	 	8466
File
Close

C:\ProgramData\System32\xfs
  MD5:  3dc1a077836de0c70907d4a89c44ce01
  SHA1: c047af193c183163b991d485615e6f717a172448
	604	 	8668
File
Hide

C:\ProgramData\System32\xfs
  MD5:  3dc1a077836de0c70907d4a89c44ce01
  SHA1: c047af193c183163b991d485615e6f717a172448
	604	 	8668
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Motorola.xml
  MD5:  ffcd80631c51cc6b489c238ef7761d1d
  SHA1: 4142df7c05522953e2a1df961f97628034fab8e3
	604	 	6335
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Motorola.xml
  MD5:  ffcd80631c51cc6b489c238ef7761d1d
  SHA1: 4142df7c05522953e2a1df961f97628034fab8e3
	604	 	6335
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Motorola.xml
  MD5:  d67107ac114a8c4e9f9240b06448c9ce
  SHA1: 4cf276cc1d71e9329c39d086aaaffb38d9d2e4bc
	604	 	6336
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Motorola.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\W3MxEkwumT6qf1PQYY7e804NK3+okMp7aOEy2172Mp
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  d67107ac114a8c4e9f9240b06448c9ce
  SHA1: 4cf276cc1d71e9329c39d086aaaffb38d9d2e4bc
	604	 	6336
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\LG.xml
	604	 	6249
File
Open

C:\ProgramData\System32\xfs
  MD5:  3dc1a077836de0c70907d4a89c44ce01
  SHA1: c047af193c183163b991d485615e6f717a172448
	604	 	8668
File
Close

C:\ProgramData\System32\xfs
  MD5:  981003f2d780d7d6208709a805bd33e0
  SHA1: b900d15729abca028fe4fd88c6d4b3151dac9370
	604	 	8854
File
Hide

C:\ProgramData\System32\xfs
  MD5:  981003f2d780d7d6208709a805bd33e0
  SHA1: b900d15729abca028fe4fd88c6d4b3151dac9370
	604	 	8854
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\LG.xml
  MD5:  a5b6b5270ff62d9a1f45bfebd4e22a81
  SHA1: 1efd65a0a28bb0da73960b423fb03c6950005598
	604	 	6633
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\LG.xml
  MD5:  a5b6b5270ff62d9a1f45bfebd4e22a81
  SHA1: 1efd65a0a28bb0da73960b423fb03c6950005598
	604	 	6633
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\LG.xml
  MD5:  60a4027f7cfe86e41eb3170eaf6df55e
  SHA1: 4fc33bc6fce98cfc7b4e25e0b82436a94cfa2f8d
	604	 	6640
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\LG.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\RGr8JRRhObk5OJvjVTJRsg==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  60a4027f7cfe86e41eb3170eaf6df55e
  SHA1: 4fc33bc6fce98cfc7b4e25e0b82436a94cfa2f8d
	604	 	6640
File
Open

C:\ProgramData\System32\xfs
  MD5:  981003f2d780d7d6208709a805bd33e0
  SHA1: b900d15729abca028fe4fd88c6d4b3151dac9370
	604	 	8854
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iTunes.xml
	604	 	4509
File
Close

C:\ProgramData\System32\xfs
  MD5:  8f53d63be4b3e81743836fd4d30546ad
  SHA1: a645e7d47e7ecdc5132e994a77546508f5c2f838
	604	 	9028
File
Hide

C:\ProgramData\System32\xfs
  MD5:  8f53d63be4b3e81743836fd4d30546ad
  SHA1: a645e7d47e7ecdc5132e994a77546508f5c2f838
	604	 	9028
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iTunes.xml
  MD5:  0074d823e62804fe91888b080e0e1160
  SHA1: 23cade50f29d61a3e1cba20959b906f10e6ede73
	604	 	4893
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iTunes.xml
  MD5:  0074d823e62804fe91888b080e0e1160
  SHA1: 23cade50f29d61a3e1cba20959b906f10e6ede73
	604	 	4893
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iTunes.xml
  MD5:  56c5041dd4d279f53897c0c04aaa9814
  SHA1: e83b9393ac9288d3129812c84f7a0098c436377f
	604	 	4896
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iTunes.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\lJqDbyi7QRnMH3ERqljrJwlmUnPhzk7ocQbHB2qjTb
   0=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  56c5041dd4d279f53897c0c04aaa9814
  SHA1: e83b9393ac9288d3129812c84f7a0098c436377f
	604	 	4896
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPod.xml
	604	 	4608
File
Open

C:\ProgramData\System32\xfs
  MD5:  8f53d63be4b3e81743836fd4d30546ad
  SHA1: a645e7d47e7ecdc5132e994a77546508f5c2f838
	604	 	9028
File
Close

C:\ProgramData\System32\xfs
  MD5:  a13828ac34fe0323b30a0eee1d51d518
  SHA1: e78e1a943bbb629d5671f413168a987e004622a3
	604	 	9210
File
Hide

C:\ProgramData\System32\xfs
  MD5:  a13828ac34fe0323b30a0eee1d51d518
  SHA1: e78e1a943bbb629d5671f413168a987e004622a3
	604	 	9210
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPod.xml
  MD5:  deaac5a83902073a874a0036e8d97c25
  SHA1: 2d034360d6e3a55bf2a0fe52e15b7fef2bbb9740
	604	 	4992
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPod.xml
  MD5:  deaac5a83902073a874a0036e8d97c25
  SHA1: 2d034360d6e3a55bf2a0fe52e15b7fef2bbb9740
	604	 	4992
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPod.xml
  MD5:  9a23dcb320791fca36ece081a5e5c41e
  SHA1: 602f70a0fcd2ce4e3714cfc3018ff348875a0dd3
	604	 	4992
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPod.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\K4BaNvbw9uapwphCowjUHQ==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  9a23dcb320791fca36ece081a5e5c41e
  SHA1: 602f70a0fcd2ce4e3714cfc3018ff348875a0dd3
	604	 	4992
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone5.xml
	604	 	4653
File
Open

C:\ProgramData\System32\xfs
  MD5:  a13828ac34fe0323b30a0eee1d51d518
  SHA1: e78e1a943bbb629d5671f413168a987e004622a3
	604	 	9210
File
Close

C:\ProgramData\System32\xfs
  MD5:  cf6a9bcaa4cc789e3f7c98ec750fbf59
  SHA1: 05f2c37eaee472727e5dd1de6a61cb16ab05bd6b
	604	 	9388
File
Hide

C:\ProgramData\System32\xfs
  MD5:  cf6a9bcaa4cc789e3f7c98ec750fbf59
  SHA1: 05f2c37eaee472727e5dd1de6a61cb16ab05bd6b
	604	 	9388
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone5.xml
  MD5:  68564e9e065bd0e666cd99d6df9b5eff
  SHA1: 7dc8dad6098b23f97d0509bee156366327fc810c
	604	 	5037
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone5.xml
  MD5:  68564e9e065bd0e666cd99d6df9b5eff
  SHA1: 7dc8dad6098b23f97d0509bee156366327fc810c
	604	 	5037
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone5.xml
  MD5:  4a38510f581e03ebacde3fb221fadf80
  SHA1: ce96b572493bb2faaa26cd6a459f983fd10cd9ca
	604	 	5040
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone5.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\qJBrPEVU4M5QpFREI84TRe+SaY5ImjATVXb9rMlqHz
   I=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  4a38510f581e03ebacde3fb221fadf80
  SHA1: ce96b572493bb2faaa26cd6a459f983fd10cd9ca
	604	 	5040
File
Open

C:\ProgramData\System32\xfs
  MD5:  cf6a9bcaa4cc789e3f7c98ec750fbf59
  SHA1: 05f2c37eaee472727e5dd1de6a61cb16ab05bd6b
	604	 	9388
File
Close

C:\ProgramData\System32\xfs
  MD5:  ecc212d1b7586b1bd4276c9dd46bbf41
  SHA1: 9eec229cef45fe795dc3d3a471719b86883644d1
	604	 	9572
File
Hide

C:\ProgramData\System32\xfs
  MD5:  ecc212d1b7586b1bd4276c9dd46bbf41
  SHA1: 9eec229cef45fe795dc3d3a471719b86883644d1
	604	 	9572
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone4.xml
	604	 	4514
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone4.xml
  MD5:  efb15a30cf8de043fb41fe220b27d221
  SHA1: 101e8384bd56c9771f9bc954c55bf37d5912dc9f
	604	 	4898
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone4.xml
  MD5:  efb15a30cf8de043fb41fe220b27d221
  SHA1: 101e8384bd56c9771f9bc954c55bf37d5912dc9f
	604	 	4898
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone4.xml
  MD5:  b7db7c3657fbe4551d12267bb825f397
  SHA1: cdc4e49fe1158f1ee02a14a3aba96655a80ed4f0
	604	 	4912
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone4.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cy4rvq3gw9dg7Lrfkc+iquzkGHMx-E8c2l1F5wTtjt
   M=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  b7db7c3657fbe4551d12267bb825f397
  SHA1: cdc4e49fe1158f1ee02a14a3aba96655a80ed4f0
	604	 	4912
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone.xml
	604	 	4575
File
Open

C:\ProgramData\System32\xfs
  MD5:  ecc212d1b7586b1bd4276c9dd46bbf41
  SHA1: 9eec229cef45fe795dc3d3a471719b86883644d1
	604	 	9572
File
Close

C:\ProgramData\System32\xfs
  MD5:  c540281564da97f35f7c809330b77591
  SHA1: 38ae85b39549d6c1c83d5da0867b07a582dc8b86
	604	 	9756
File
Hide

C:\ProgramData\System32\xfs
  MD5:  c540281564da97f35f7c809330b77591
  SHA1: 38ae85b39549d6c1c83d5da0867b07a582dc8b86
	604	 	9756
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone.xml
  MD5:  293d60e2959e5ac47e355c54a1e69dfc
  SHA1: a61c6fc10d816268ee71935fce3ea57fcf82e87e
	604	 	4959
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone.xml
  MD5:  293d60e2959e5ac47e355c54a1e69dfc
  SHA1: a61c6fc10d816268ee71935fce3ea57fcf82e87e
	604	 	4959
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone.xml
  MD5:  3d690554e544230bd3f1e77a919fbef3
  SHA1: 38fc0d2faf7bc4751852ace53ecfc32ab19b5255
	604	 	4960
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPhone.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\0oYa02CPiUSrtVBSPCvREhelsmq7i57tqEsTr4sJIy
   U=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  3d690554e544230bd3f1e77a919fbef3
  SHA1: 38fc0d2faf7bc4751852ace53ecfc32ab19b5255
	604	 	4960
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad3.xml
	604	 	4733
File
Open

C:\ProgramData\System32\xfs
  MD5:  c540281564da97f35f7c809330b77591
  SHA1: 38ae85b39549d6c1c83d5da0867b07a582dc8b86
	604	 	9756
File
Close

C:\ProgramData\System32\xfs
  MD5:  1afe614f2f9ddf2d8448e60b26037079
  SHA1: aeffc6c11dd6c3ea0f5f0b4afbd0b77f917662e0
	604	 	9938
File
Hide

C:\ProgramData\System32\xfs
  MD5:  1afe614f2f9ddf2d8448e60b26037079
  SHA1: aeffc6c11dd6c3ea0f5f0b4afbd0b77f917662e0
	604	 	9938
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad3.xml
  MD5:  aa45160f55a9b62428513787d7132a73
  SHA1: 40677af43d2930c9369f951c6f31ebfda865f7df
	604	 	5117
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad3.xml
  MD5:  aa45160f55a9b62428513787d7132a73
  SHA1: 40677af43d2930c9369f951c6f31ebfda865f7df
	604	 	5117
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad3.xml
  MD5:  bdb358b129dd290e98cdaf2ee09d3509
  SHA1: f669cd7186228dcc1f3d15b5ced26539e46c36d2
	604	 	5120
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad3.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\rNr1WjfoAr5HKfhss6GHM1UyR9PXWoM6SPnQrTBkNK
   o=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  bdb358b129dd290e98cdaf2ee09d3509
  SHA1: f669cd7186228dcc1f3d15b5ced26539e46c36d2
	604	 	5120
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad.xml
	604	 	4470
File
Open

C:\ProgramData\System32\xfs
  MD5:  1afe614f2f9ddf2d8448e60b26037079
  SHA1: aeffc6c11dd6c3ea0f5f0b4afbd0b77f917662e0
	604	 	9938
File
Close

C:\ProgramData\System32\xfs
  MD5:  422411d2000f9bf8bebeac1d07ec5b93
  SHA1: a9a93e98deb1df9797e03052bf0544b4470a0b37
	604	 	10118
File
Hide

C:\ProgramData\System32\xfs
  MD5:  422411d2000f9bf8bebeac1d07ec5b93
  SHA1: a9a93e98deb1df9797e03052bf0544b4470a0b37
	604	 	10118
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad.xml
  MD5:  975a4d160191d874401ba7676e44841a
  SHA1: 0e3a1331f24972b73349c4d1881f8522c83557b3
	604	 	4854
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad.xml
  MD5:  975a4d160191d874401ba7676e44841a
  SHA1: 0e3a1331f24972b73349c4d1881f8522c83557b3
	604	 	4854
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad.xml
  MD5:  d6ca7d0fbce3ec5fbe09792bca8f8bac
  SHA1: a39956fda6d5e1500bc4174e6359e9a482c0b3cb
	604	 	4864
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\iPad.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\D4Cq9GlHFuf36r4EEvC2kA==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  d6ca7d0fbce3ec5fbe09792bca8f8bac
  SHA1: a39956fda6d5e1500bc4174e6359e9a482c0b3cb
	604	 	4864
File
Open

C:\ProgramData\System32\xfs
  MD5:  422411d2000f9bf8bebeac1d07ec5b93
  SHA1: a9a93e98deb1df9797e03052bf0544b4470a0b37
	604	 	10118
File
Close

C:\ProgramData\System32\xfs
  MD5:  a94296ba41dfa95c97c58e5b2db01d89
  SHA1: f7346a85135d84b8fc5c89ba64751a842946f49c
	604	 	10296
File
Hide

C:\ProgramData\System32\xfs
  MD5:  a94296ba41dfa95c97c58e5b2db01d89
  SHA1: f7346a85135d84b8fc5c89ba64751a842946f49c
	604	 	10296
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCTouchDiamond.xml
	604	 	7209
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCTouchDiamond.xml
  MD5:  45c8981b9721a77e5f6422afd0e1b621
  SHA1: bec73c31aa723f736a0f7993860f7308b5db16f7
	604	 	7593
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCTouchDiamond.xml
  MD5:  45c8981b9721a77e5f6422afd0e1b621
  SHA1: bec73c31aa723f736a0f7993860f7308b5db16f7
	604	 	7593
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCTouchDiamond.xml
  MD5:  ab4dd29c5657a34c219c2df554652d5c
  SHA1: ec0622e436047fbb24a22acc368cf248767e8f86
	604	 	7600
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCTouchDiamond.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\1jXfXWMb8PDGy5xLM61+wxuKf1exQzSmJgwvk5uzQp
   NcTteCUr6++ZhPzmm9eoWY.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ab4dd29c5657a34c219c2df554652d5c
  SHA1: ec0622e436047fbb24a22acc368cf248767e8f86
	604	 	7600
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCHero.xml
	604	 	7287
File
Open

C:\ProgramData\System32\xfs
  MD5:  a94296ba41dfa95c97c58e5b2db01d89
  SHA1: f7346a85135d84b8fc5c89ba64751a842946f49c
	604	 	10296
File
Close

C:\ProgramData\System32\xfs
  MD5:  b57ba3d7a172383697c4d494750da2c3
  SHA1: 3c29b7f2e748acf40b5a1eef7e5ed4ba4f356a06
	604	 	10496
File
Hide

C:\ProgramData\System32\xfs
  MD5:  b57ba3d7a172383697c4d494750da2c3
  SHA1: 3c29b7f2e748acf40b5a1eef7e5ed4ba4f356a06
	604	 	10496
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCHero.xml
  MD5:  2ac0943a53d6f0edb396d33f1fd0f848
  SHA1: 366577deda14b00b9c35ff9b9d4fcfc95783b816
	604	 	7671
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCHero.xml
  MD5:  2ac0943a53d6f0edb396d33f1fd0f848
  SHA1: 366577deda14b00b9c35ff9b9d4fcfc95783b816
	604	 	7671
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCHero.xml
  MD5:  ade598ff9bbbb137d980bfcd614613d1
  SHA1: 6f7656e076aae0248b6558ebb95dddc67e5cfc3e
	604	 	7680
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCHero.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\YEVe3rMyxpYkuCfaf0MaBoy8QDO9GsezI+7Oj0ClYx
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ade598ff9bbbb137d980bfcd614613d1
  SHA1: 6f7656e076aae0248b6558ebb95dddc67e5cfc3e
	604	 	7680
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCEvo.xml
	604	 	7306
File
Open

C:\ProgramData\System32\xfs
  MD5:  b57ba3d7a172383697c4d494750da2c3
  SHA1: 3c29b7f2e748acf40b5a1eef7e5ed4ba4f356a06
	604	 	10496
File
Close

C:\ProgramData\System32\xfs
  MD5:  d7f45b81966f4677f967df09d776cbde
  SHA1: 11ed145d6583ed95bff36e98e963d90de9959a21
	604	 	10680
File
Hide

C:\ProgramData\System32\xfs
  MD5:  d7f45b81966f4677f967df09d776cbde
  SHA1: 11ed145d6583ed95bff36e98e963d90de9959a21
	604	 	10680
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCEvo.xml
  MD5:  a434771efc92fda02982178f1664393d
  SHA1: 921a2fc0ec15de1894d4323cb47e0004c4e8d55a
	604	 	7690
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCEvo.xml
  MD5:  a434771efc92fda02982178f1664393d
  SHA1: 921a2fc0ec15de1894d4323cb47e0004c4e8d55a
	604	 	7690
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCEvo.xml
  MD5:  2e424414185cdf578af400da19f2db5e
  SHA1: abe1d349094214b59514a7b8db0babe959916908
	604	 	7696
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTCEvo.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\bHqXqfQXtqw7Omj+hd6FbDBCdPs8t4DONY99FPziay
   k=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  2e424414185cdf578af400da19f2db5e
  SHA1: abe1d349094214b59514a7b8db0babe959916908
	604	 	7696
File
Open

C:\ProgramData\System32\xfs
  MD5:  d7f45b81966f4677f967df09d776cbde
  SHA1: 11ed145d6583ed95bff36e98e963d90de9959a21
	604	 	10680
File
Close

C:\ProgramData\System32\xfs
  MD5:  32ea53b9c0818d90581228724b1bb307
  SHA1: 43c0a85cc0b2d76f7795b4046b4985049e0a9470
	604	 	10862
File
Hide

C:\ProgramData\System32\xfs
  MD5:  32ea53b9c0818d90581228724b1bb307
  SHA1: 43c0a85cc0b2d76f7795b4046b4985049e0a9470
	604	 	10862
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1X.xml
	604	 	9129
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1X.xml
  MD5:  4888779182bf8bd708239876234da33c
  SHA1: a100821284bdc40cc0a38a0902818c016c42d978
	604	 	9513
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1X.xml
  MD5:  4888779182bf8bd708239876234da33c
  SHA1: a100821284bdc40cc0a38a0902818c016c42d978
	604	 	9513
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1X.xml
  MD5:  72458a8dc63cd2e5c1d6f5c6be35020a
  SHA1: fc9de2cadac28844960366865e16f7bcafbeb4e6
	604	 	9520
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1X.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\fFaLpscuXlh2nN8rxURCAiR5UCQG2U6Giov+u2wmI9
   A=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  72458a8dc63cd2e5c1d6f5c6be35020a
  SHA1: fc9de2cadac28844960366865e16f7bcafbeb4e6
	604	 	9520
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1S.xml
	604	 	9398
File
Open

C:\ProgramData\System32\xfs
  MD5:  32ea53b9c0818d90581228724b1bb307
  SHA1: 43c0a85cc0b2d76f7795b4046b4985049e0a9470
	604	 	10862
File
Close

C:\ProgramData\System32\xfs
  MD5:  425d93bc2a6ef2c1243c54af7f236f45
  SHA1: c910cab4276c22fb737f7ea705ee353b879a16fa
	604	 	11042
File
Hide

C:\ProgramData\System32\xfs
  MD5:  425d93bc2a6ef2c1243c54af7f236f45
  SHA1: c910cab4276c22fb737f7ea705ee353b879a16fa
	604	 	11042
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1S.xml
  MD5:  ba0d9b20596496baa1a4d9114a6f57c0
  SHA1: 9e7297fd05262a619a3cb29848b97f809763cb4b
	604	 	9782
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1S.xml
  MD5:  ba0d9b20596496baa1a4d9114a6f57c0
  SHA1: 9e7297fd05262a619a3cb29848b97f809763cb4b
	604	 	9782
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1S.xml
  MD5:  ad0b91e8518e400b018984996039aca5
  SHA1: e546e4f61edbd9a112cf61f61ab46599896ed34a
	604	 	9792
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC1S.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\RU9znbxpeZf9GsMH5wi8NpqTxtGNDMEs4sN4KKiizh
   M=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ad0b91e8518e400b018984996039aca5
  SHA1: e546e4f61edbd9a112cf61f61ab46599896ed34a
	604	 	9792
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC.xml
	604	 	7554
File
Open

C:\ProgramData\System32\xfs
  MD5:  425d93bc2a6ef2c1243c54af7f236f45
  SHA1: c910cab4276c22fb737f7ea705ee353b879a16fa
	604	 	11042
File
Close

C:\ProgramData\System32\xfs
  MD5:  d137c15c7ab90948e800f3d1e8aa2034
  SHA1: 77186409ea44bfebc7f88c35aa714c81fa84167a
	604	 	11222
File
Hide

C:\ProgramData\System32\xfs
  MD5:  d137c15c7ab90948e800f3d1e8aa2034
  SHA1: 77186409ea44bfebc7f88c35aa714c81fa84167a
	604	 	11222
API Call

  API Name:  Sleep   Address:  0x0040e6c8
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe   DLL Name:  kernel32.dll
	604
High  Cpu

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\"xcnt" = 66
	604
ProcessTelemetryReport

  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC.xml
  MD5:  108519e74ead11e621e22aaa44f17869
  SHA1: 597dc8ea5bd62a0bd2ffb6c996663569611bda9e
	604	 	7938
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC.xml
  MD5:  108519e74ead11e621e22aaa44f17869
  SHA1: 597dc8ea5bd62a0bd2ffb6c996663569611bda9e
	604	 	7938
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC.xml
  MD5:  b9fb3451b1f67c38c970a32832fa5b4b
  SHA1: 6a60bcc4952b6f159a25c62666dbfeddf8bece72
	604	 	7952
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\HTC.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\aRSwpU2l+M-z1SNFjWmv9A==.7A2F0ADB1B90B147D
   ABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  b9fb3451b1f67c38c970a32832fa5b4b
  SHA1: 6a60bcc4952b6f159a25c62666dbfeddf8bece72
	604	 	7952
File
Open

C:\ProgramData\System32\xfs
  MD5:  d137c15c7ab90948e800f3d1e8aa2034
  SHA1: 77186409ea44bfebc7f88c35aa714c81fa84167a
	604	 	11222
File
Close

C:\ProgramData\System32\xfs
  MD5:  7bfdaf9d9e54f0d325c37a6a938422f2
  SHA1: 78df3e627fa3108a6b8d97d55dd6a3f0198a41df
	604	 	11398
File
Hide

C:\ProgramData\System32\xfs
  MD5:  7bfdaf9d9e54f0d325c37a6a938422f2
  SHA1: 78df3e627fa3108a6b8d97d55dd6a3f0198a41df
	604	 	11398
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Groups.xml
	604	 	233
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Groups.xml
  MD5:  92cb14554d0223c2996317551f1ea82c
  SHA1: 67092b3bffb5264a1c4dcfe707abbcbac2f4ecf5
	604	 	617
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Groups.xml
  MD5:  92cb14554d0223c2996317551f1ea82c
  SHA1: 67092b3bffb5264a1c4dcfe707abbcbac2f4ecf5
	604	 	617
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Groups.xml
  MD5:  09391d163591391d5287f4ed9d5a3767
  SHA1: 589bde79d3da84fdd1d9f2a5c9290bd2faeaf09d
	604	 	624
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Groups.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\-D0JMA3HNfYA20bYPFUmqdCM1huLo4z-ivKQcMzfn0
   0=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  09391d163591391d5287f4ed9d5a3767
  SHA1: 589bde79d3da84fdd1d9f2a5c9290bd2faeaf09d
	604	 	624
File
Open

C:\ProgramData\System32\xfs
  MD5:  7bfdaf9d9e54f0d325c37a6a938422f2
  SHA1: 78df3e627fa3108a6b8d97d55dd6a3f0198a41df
	604	 	11398
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Generic.xml
	604	 	13985
File
Close

C:\ProgramData\System32\xfs
  MD5:  facc26b694fc1911c7b311bc11dcef18
  SHA1: 50a651a70a34dfd80b118b5fd1770bdee7045fc7
	604	 	11580
File
Hide

C:\ProgramData\System32\xfs
  MD5:  facc26b694fc1911c7b311bc11dcef18
  SHA1: 50a651a70a34dfd80b118b5fd1770bdee7045fc7
	604	 	11580
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Generic.xml
  MD5:  6ba2f895fe3ace63e6a72100be165a69
  SHA1: 1c9fedcf4304639f23de83f31955fb634f15a654
	604	 	14369
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Generic.xml
  MD5:  6ba2f895fe3ace63e6a72100be165a69
  SHA1: 1c9fedcf4304639f23de83f31955fb634f15a654
	604	 	14369
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Generic.xml
  MD5:  f60ba83ec82e5c5c91ec5307dc6cd666
  SHA1: 863e476df668c5ed173e5e74e91da8c89128a506
	604	 	14384
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Generic.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\hqH5LG3GpZTqU7TOPZDJRPGuwcRCAdoAcHJLVSXuY2
   0=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  f60ba83ec82e5c5c91ec5307dc6cd666
  SHA1: 863e476df668c5ed173e5e74e91da8c89128a506
	604	 	14384
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wmv.xml
	604	 	3449
File
Open

C:\ProgramData\System32\xfs
  MD5:  facc26b694fc1911c7b311bc11dcef18
  SHA1: 50a651a70a34dfd80b118b5fd1770bdee7045fc7
	604	 	11580
File
Close

C:\ProgramData\System32\xfs
  MD5:  ef7c514675d640025d7c1ddea494fd52
  SHA1: 323260ebb3eff03c5e282b9086c1042961b7fd93
	604	 	11764
File
Hide

C:\ProgramData\System32\xfs
  MD5:  ef7c514675d640025d7c1ddea494fd52
  SHA1: 323260ebb3eff03c5e282b9086c1042961b7fd93
	604	 	11764
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wmv.xml
  MD5:  f78f2fd3266d2edccbaf4eb3e6b050df
  SHA1: db11c469f1e370260c8e6d4b4ab62a4676e4592c
	604	 	3833
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wmv.xml
  MD5:  f78f2fd3266d2edccbaf4eb3e6b050df
  SHA1: db11c469f1e370260c8e6d4b4ab62a4676e4592c
	604	 	3833
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wmv.xml
  MD5:  d16679d1605724a28fdb7fdec5cfbec7
  SHA1: 7a37c1bfe5d27d2159320d64428fe98cde996de4
	604	 	3840
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wmv.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\W1eSW9DUhh0cKr0petl++q6VcmZsMXs8Tzsvb4WMB5
   g=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  d16679d1605724a28fdb7fdec5cfbec7
  SHA1: 7a37c1bfe5d27d2159320d64428fe98cde996de4
	604	 	3840
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wma.xml
	604	 	1601
File
Open

C:\ProgramData\System32\xfs
  MD5:  ef7c514675d640025d7c1ddea494fd52
  SHA1: 323260ebb3eff03c5e282b9086c1042961b7fd93
	604	 	11764
File
Close

C:\ProgramData\System32\xfs
  MD5:  0140f63bb666f9ea8a5acbcbebd3a00d
  SHA1: b17b4a73a0b52562c4a5edaf91eebdd6dc401cd6
	604	 	11954
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0140f63bb666f9ea8a5acbcbebd3a00d
  SHA1: b17b4a73a0b52562c4a5edaf91eebdd6dc401cd6
	604	 	11954
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wma.xml
  MD5:  ad8f0a98fba13937d76da657d1e21697
  SHA1: d2d1acbb3d77f40addfdebc8fd078aa5f225507e
	604	 	1985
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wma.xml
  MD5:  ad8f0a98fba13937d76da657d1e21697
  SHA1: d2d1acbb3d77f40addfdebc8fd078aa5f225507e
	604	 	1985
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wma.xml
  MD5:  976bc81285d81f40b83063dd62345058
  SHA1: 8ff038a01b37ff19d7a5a450f7dc25825a843ffa
	604	 	2000
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wma.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\-niGLRZdtFa3W8Bwl9D5BIzDmuhOU+4BQ2rmE7Jhlk
   U=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  976bc81285d81f40b83063dd62345058
  SHA1: 8ff038a01b37ff19d7a5a450f7dc25825a843ffa
	604	 	2000
File
Open

C:\ProgramData\System32\xfs
  MD5:  0140f63bb666f9ea8a5acbcbebd3a00d
  SHA1: b17b4a73a0b52562c4a5edaf91eebdd6dc401cd6
	604	 	11954
File
Close

C:\ProgramData\System32\xfs
  MD5:  92c340aa6a5a8b0442add3f888b2b6b2
  SHA1: f1cf39263adfb16fc96660792d71da006065e8f1
	604	 	12144
File
Hide

C:\ProgramData\System32\xfs
  MD5:  92c340aa6a5a8b0442add3f888b2b6b2
  SHA1: f1cf39263adfb16fc96660792d71da006065e8f1
	604	 	12144
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wav.xml
	604	 	869
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wav.xml
  MD5:  a9370844adeeaa93b7866522f41cdb91
  SHA1: f8dc6c036d7268eb0bb604c4ad7b49696f40377b
	604	 	1253
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wav.xml
  MD5:  a9370844adeeaa93b7866522f41cdb91
  SHA1: f8dc6c036d7268eb0bb604c4ad7b49696f40377b
	604	 	1253
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wav.xml
  MD5:  fc5e4f0ad3ece153c024765e3196f7e7
  SHA1: a4628506c3de4f5f954a598d5b9a2175d49b97aa
	604	 	1264
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-wav.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\XLuqOg5Qu5-XHyiXPjV6f-TOULPEcOQ76AUCQShwBP
   Y=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  fc5e4f0ad3ece153c024765e3196f7e7
  SHA1: a4628506c3de4f5f954a598d5b9a2175d49b97aa
	604	 	1264
File
Open

C:\ProgramData\System32\xfs
  MD5:  92c340aa6a5a8b0442add3f888b2b6b2
  SHA1: f1cf39263adfb16fc96660792d71da006065e8f1
	604	 	12144
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-rv.xml
	604	 	3736
File
Close

C:\ProgramData\System32\xfs
  MD5:  2331f0ec18e8600bab81cde12524babe
  SHA1: 585bd428ecf4f63b5fc9f8bb5f223726201aa39d
	604	 	12334
File
Hide

C:\ProgramData\System32\xfs
  MD5:  2331f0ec18e8600bab81cde12524babe
  SHA1: 585bd428ecf4f63b5fc9f8bb5f223726201aa39d
	604	 	12334
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-rv.xml
  MD5:  c2e5208f80bfc2b7ad29745fddec5d3a
  SHA1: 432150ba364d7932f39c2c7fed481fdfe72a359a
	604	 	4120
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-rv.xml
  MD5:  c2e5208f80bfc2b7ad29745fddec5d3a
  SHA1: 432150ba364d7932f39c2c7fed481fdfe72a359a
	604	 	4120
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-rv.xml
  MD5:  e3074ff103a28efe8c000b9da4c24499
  SHA1: a369839b0465fafc9e49ead344b380eb22aba0f6
	604	 	4128
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-rv.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\wv4kbE3vTkkVITNgG+1OxDgZwr25gxRiXsszu6Au+n
   8=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  e3074ff103a28efe8c000b9da4c24499
  SHA1: a369839b0465fafc9e49ead344b380eb22aba0f6
	604	 	4128
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ral.xml
	604	 	929
File
Open

C:\ProgramData\System32\xfs
  MD5:  2331f0ec18e8600bab81cde12524babe
  SHA1: 585bd428ecf4f63b5fc9f8bb5f223726201aa39d
	604	 	12334
File
Close

C:\ProgramData\System32\xfs
  MD5:  32c32ddf6dd2c0bb70e47d4faa3fe015
  SHA1: 039ed11333a50682c6c9740215a25b40608e37cb
	604	 	12522
File
Hide

C:\ProgramData\System32\xfs
  MD5:  32c32ddf6dd2c0bb70e47d4faa3fe015
  SHA1: 039ed11333a50682c6c9740215a25b40608e37cb
	604	 	12522
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ral.xml
  MD5:  ec8cc3044de2f86f84e49c25dd651f32
  SHA1: f6e31c920df983c5363b57ba7f0c6c645d188af3
	604	 	1313
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ral.xml
  MD5:  ec8cc3044de2f86f84e49c25dd651f32
  SHA1: f6e31c920df983c5363b57ba7f0c6c645d188af3
	604	 	1313
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ral.xml
  MD5:  3a28cdabdd7dcbf429c4cdd72141730c
  SHA1: 0332f1e5b24f7f396223a3ec81b2d1ad7e486a98
	604	 	1328
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ral.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\ESF30494qREgUqyO-4wutBiKh6RJdj+9R6oBQeqTM7
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  3a28cdabdd7dcbf429c4cdd72141730c
  SHA1: 0332f1e5b24f7f396223a3ec81b2d1ad7e486a98
	604	 	1328
File
Open

C:\ProgramData\System32\xfs
  MD5:  32c32ddf6dd2c0bb70e47d4faa3fe015
  SHA1: 039ed11333a50682c6c9740215a25b40608e37cb
	604	 	12522
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ra10.xml
	604	 	1507
File
Close

C:\ProgramData\System32\xfs
  MD5:  22eab5a69802595c4d44e69be54ef20b
  SHA1: 3bf1a33c92610aedc4352a8dc1994ec22e84c5a4
	604	 	12712
File
Hide

C:\ProgramData\System32\xfs
  MD5:  22eab5a69802595c4d44e69be54ef20b
  SHA1: 3bf1a33c92610aedc4352a8dc1994ec22e84c5a4
	604	 	12712
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ra10.xml
  MD5:  11cdcb383dc22f04700c197aff9edc44
  SHA1: 93fcf4fbfcfc6467e07b9315722ab2cbd2fd2a45
	604	 	1891
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ra10.xml
  MD5:  11cdcb383dc22f04700c197aff9edc44
  SHA1: 93fcf4fbfcfc6467e07b9315722ab2cbd2fd2a45
	604	 	1891
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ra10.xml
  MD5:  ee57ebc3996d633fbb56a9cc51f91ef9
  SHA1: da7fc76e026dffd3b96cec656f87401e13aaeec0
	604	 	1904
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-ra10.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\2ZtJKEwIvkV8sYhNajp9AuXkg5LjhNA+MiG-bZK4wE
   w=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  ee57ebc3996d633fbb56a9cc51f91ef9
  SHA1: da7fc76e026dffd3b96cec656f87401e13aaeec0
	604	 	1904
File
Open

C:\ProgramData\System32\xfs
  MD5:  22eab5a69802595c4d44e69be54ef20b
  SHA1: 3bf1a33c92610aedc4352a8dc1994ec22e84c5a4
	604	 	12712
File
Close

C:\ProgramData\System32\xfs
  MD5:  0873147a6aaa5e4b1c0cf592f455fe64
  SHA1: c4c292ebb5fe238c2cde93fa7f002aea7b03fdd4
	604	 	12904
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0873147a6aaa5e4b1c0cf592f455fe64
  SHA1: c4c292ebb5fe238c2cde93fa7f002aea7b03fdd4
	604	 	12904
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp4.xml
	604	 	3178
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp4.xml
  MD5:  6d4fd729d5a9c1107247aaad61b60039
  SHA1: a8d38fe63ae6af1e270e91fca2a8c16a4778618c
	604	 	3562
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp4.xml
  MD5:  6d4fd729d5a9c1107247aaad61b60039
  SHA1: a8d38fe63ae6af1e270e91fca2a8c16a4778618c
	604	 	3562
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp4.xml
  MD5:  96688ca879566f9560f2efda67506650
  SHA1: 923c4e194483607287ac1b94c76390850520f691
	604	 	3568
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp4.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\VnjG3JfRn2B1G0EZefSXX1ClB+mg5KKJx5UNf84z3-
   k=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  96688ca879566f9560f2efda67506650
  SHA1: 923c4e194483607287ac1b94c76390850520f691
	604	 	3568
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp3.xml
	604	 	1330
File
Open

C:\ProgramData\System32\xfs
  MD5:  0873147a6aaa5e4b1c0cf592f455fe64
  SHA1: c4c292ebb5fe238c2cde93fa7f002aea7b03fdd4
	604	 	12904
File
Close

C:\ProgramData\System32\xfs
  MD5:  0ffb6876589bef4633bba1ec3ee1dc75
  SHA1: 4f19caf3dcabea53c7b9b97cf81200e26a2454f1
	604	 	13094
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0ffb6876589bef4633bba1ec3ee1dc75
  SHA1: 4f19caf3dcabea53c7b9b97cf81200e26a2454f1
	604	 	13094
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp3.xml
  MD5:  1ee92dcf64ba278b25639289e1cabfee
  SHA1: 3348f80dfa1e72437e2f4d29d618cdd050293912
	604	 	1714
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp3.xml
  MD5:  1ee92dcf64ba278b25639289e1cabfee
  SHA1: 3348f80dfa1e72437e2f4d29d618cdd050293912
	604	 	1714
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp3.xml
  MD5:  aeaa7e710215ebe88f87cef1c8e6bedb
  SHA1: 8bc0a2e5d5ddabb27d6bff89da564c75ecbb1917
	604	 	1728
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-mp3.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\9aWFb73eaa96tLoz2dJfTiYX44Asaro8dqKVReVbvH
   8=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  aeaa7e710215ebe88f87cef1c8e6bedb
  SHA1: 8bc0a2e5d5ddabb27d6bff89da564c75ecbb1917
	604	 	1728
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264apple.xml
	604	 	5061
File
Open

C:\ProgramData\System32\xfs
  MD5:  0ffb6876589bef4633bba1ec3ee1dc75
  SHA1: 4f19caf3dcabea53c7b9b97cf81200e26a2454f1
	604	 	13094
File
Close

C:\ProgramData\System32\xfs
  MD5:  5bb781d47d4d81f450d109eec3e9f019
  SHA1: 4cd92fd070b092e92d071026f0c2647caedd649b
	604	 	13284
File
Hide

C:\ProgramData\System32\xfs
  MD5:  5bb781d47d4d81f450d109eec3e9f019
  SHA1: 4cd92fd070b092e92d071026f0c2647caedd649b
	604	 	13284
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264apple.xml
  MD5:  03d3ad324d70cf6d48af77184f4ee163
  SHA1: 0af230475aaffff933d46fad2e6215218022af0d
	604	 	5445
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264apple.xml
  MD5:  03d3ad324d70cf6d48af77184f4ee163
  SHA1: 0af230475aaffff933d46fad2e6215218022af0d
	604	 	5445
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264apple.xml
  MD5:  d7cef1215ae478f8eb756e0d999dfb29
  SHA1: 1988cacfb4630272e42aa8be071164cdddd1eac0
	604	 	5456
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264apple.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Xvb8AH1+3u3cvay-yEd06jZBmwX16RVH1J2UReg8lv
   Gn6oWv6QYe6G19gAyotIrn.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  d7cef1215ae478f8eb756e0d999dfb29
  SHA1: 1988cacfb4630272e42aa8be071164cdddd1eac0
	604	 	5456
File
Open

C:\ProgramData\System32\xfs
  MD5:  5bb781d47d4d81f450d109eec3e9f019
  SHA1: 4cd92fd070b092e92d071026f0c2647caedd649b
	604	 	13284
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264.xml
	604	 	3238
File
Close

C:\ProgramData\System32\xfs
  MD5:  0e14e23c5a429768dae8db374a7b3229
  SHA1: d503d92994f4869fbe678a98e4f3129e7df40d4f
	604	 	13486
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0e14e23c5a429768dae8db374a7b3229
  SHA1: d503d92994f4869fbe678a98e4f3129e7df40d4f
	604	 	13486
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264.xml
  MD5:  91c3999d104ee0bd06bffbaf309e9a56
  SHA1: 5fb2df23d87646d27a5fd26543509d2a69233995
	604	 	3622
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264.xml
  MD5:  91c3999d104ee0bd06bffbaf309e9a56
  SHA1: 5fb2df23d87646d27a5fd26543509d2a69233995
	604	 	3622
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264.xml
  MD5:  f00a91b1c90e8823e55dc95f87a2cb61
  SHA1: 2ffbe469b29f005e8cdd021e05bd7be2a4d3277b
	604	 	3632
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-h264.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\3te7UM3CwsHEQ5Jqt+c22RKLn7idVTfEzT3wxaMx2f
   k=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  f00a91b1c90e8823e55dc95f87a2cb61
  SHA1: 2ffbe469b29f005e8cdd021e05bd7be2a4d3277b
	604	 	3632
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-aac.xml
	604	 	1331
File
Open

C:\ProgramData\System32\xfs
  MD5:  0e14e23c5a429768dae8db374a7b3229
  SHA1: d503d92994f4869fbe678a98e4f3129e7df40d4f
	604	 	13486
File
Close

C:\ProgramData\System32\xfs
  MD5:  ee78c6bcff9ad38475bc8f1cfe59cc7a
  SHA1: 533d35f66c0a34d32b513d2a8eee22fb343d4b9a
	604	 	13678
File
Hide

C:\ProgramData\System32\xfs
  MD5:  ee78c6bcff9ad38475bc8f1cfe59cc7a
  SHA1: 533d35f66c0a34d32b513d2a8eee22fb343d4b9a
	604	 	13678
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-aac.xml
  MD5:  df0f730dbc6c1c8ceaf7ef2708dc744a
  SHA1: c57d39a241ea3d32fb928d7f542d49a149c6800d
	604	 	1715
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-aac.xml
  MD5:  df0f730dbc6c1c8ceaf7ef2708dc744a
  SHA1: c57d39a241ea3d32fb928d7f542d49a149c6800d
	604	 	1715
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-aac.xml
  MD5:  c66aeb3d3d68a09b563fa1676c85320b
  SHA1: 861322d2ede4d5108bfdb9d60e6df1376e16ee86
	604	 	1728
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-aac.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\26GrUqNW1h5f0Mv4uU7+nFqpQ2Vj03SYOZDV-m6QCv
   4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  c66aeb3d3d68a09b563fa1676c85320b
  SHA1: 861322d2ede4d5108bfdb9d60e6df1376e16ee86
	604	 	1728
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-3gp.xml
	604	 	2708
File
Open

C:\ProgramData\System32\xfs
  MD5:  ee78c6bcff9ad38475bc8f1cfe59cc7a
  SHA1: 533d35f66c0a34d32b513d2a8eee22fb343d4b9a
	604	 	13678
File
Close

C:\ProgramData\System32\xfs
  MD5:  f51287c2a41ba93e942c3bd03d8779d1
  SHA1: f0aeffcae023aacda3b64d7e4f4770014c88e66c
	604	 	13868
File
Hide

C:\ProgramData\System32\xfs
  MD5:  f51287c2a41ba93e942c3bd03d8779d1
  SHA1: f0aeffcae023aacda3b64d7e4f4770014c88e66c
	604	 	13868
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-3gp.xml
  MD5:  ddd7b63545db76d1dd8751b0e38e06b4
  SHA1: 31a25f36ddcfb8331c1bc8b9275d24b3a7b3dcdf
	604	 	3092
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-3gp.xml
  MD5:  ddd7b63545db76d1dd8751b0e38e06b4
  SHA1: 31a25f36ddcfb8331c1bc8b9275d24b3a7b3dcdf
	604	 	3092
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-3gp.xml
  MD5:  d8ad1a1dee9d3d9012dfce2aab5ec330
  SHA1: 21be739135694ee4188fdead774cda5079425ce4
	604	 	3104
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Format-3gp.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\UWG-ktkHumCkVu8nBdRlWrvEw+EBUU4IYhkwyMGrwY
   E=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  d8ad1a1dee9d3d9012dfce2aab5ec330
  SHA1: 21be739135694ee4188fdead774cda5079425ce4
	604	 	3104
File
Open

C:\ProgramData\System32\xfs
  MD5:  f51287c2a41ba93e942c3bd03d8779d1
  SHA1: f0aeffcae023aacda3b64d7e4f4770014c88e66c
	604	 	13868
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Custom.xml
	604	 	13789
File
Close

C:\ProgramData\System32\xfs
  MD5:  8537d52b4e353059734c55aec90eea11
  SHA1: 6a97dab984864ecb8bbb1a4fdaf1178861c1e051
	604	 	14058
File
Hide

C:\ProgramData\System32\xfs
  MD5:  8537d52b4e353059734c55aec90eea11
  SHA1: 6a97dab984864ecb8bbb1a4fdaf1178861c1e051
	604	 	14058
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Custom.xml
  MD5:  5a245a647fa97c0ca828a667296fbdff
  SHA1: cd26cd765978e408bef32d359b478674efd71dfc
	604	 	14173
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Custom.xml
  MD5:  5a245a647fa97c0ca828a667296fbdff
  SHA1: cd26cd765978e408bef32d359b478674efd71dfc
	604	 	14173
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Custom.xml
  MD5:  e7df79c905c570649e17d5b761b4e581
  SHA1: d1dc329256662e8abccc1b44fbf0451b9e472998
	604	 	14176
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Custom.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\cIso+FvEtOBev3kx1ypCQVlvfDUnzXklCZ1TPHm6tZ
   A=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  e7df79c905c570649e17d5b761b4e581
  SHA1: d1dc329256662e8abccc1b44fbf0451b9e472998
	604	 	14176
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cellphone.xml
	604	 	3285
File
Open

C:\ProgramData\System32\xfs
  MD5:  8537d52b4e353059734c55aec90eea11
  SHA1: 6a97dab984864ecb8bbb1a4fdaf1178861c1e051
	604	 	14058
File
Close

C:\ProgramData\System32\xfs
  MD5:  9ae0c2608081bcc67e80aa59d28a44e0
  SHA1: 3086ab5e43362971b3756b3bc1b1e01775185a98
	604	 	14240
File
Hide

C:\ProgramData\System32\xfs
  MD5:  9ae0c2608081bcc67e80aa59d28a44e0
  SHA1: 3086ab5e43362971b3756b3bc1b1e01775185a98
	604	 	14240
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cellphone.xml
  MD5:  e181a5dc410ebe4c6ca45bc2e656ccf7
  SHA1: 9a94610deba18e2242631f8b3ef030d1c207f3c9
	604	 	3669
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cellphone.xml
  MD5:  e181a5dc410ebe4c6ca45bc2e656ccf7
  SHA1: 9a94610deba18e2242631f8b3ef030d1c207f3c9
	604	 	3669
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cellphone.xml
  MD5:  1c39e28b7125bdda8f05a6a3c6109f05
  SHA1: 73354886d36e5854966406db8f49dee945df2c60
	604	 	3680
File
Rename

Old Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\Cellphone.xml
New Name:   C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\uIleu+aNka9l8RN2Ed-LadSCP+D0vzsUQDh5K9pYsp
   M=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
  MD5:  1c39e28b7125bdda8f05a6a3c6109f05
  SHA1: 73354886d36e5854966406db8f49dee945df2c60
	604	 	3680
File
Open

C:\ProgramData\System32\xfs
  MD5:  9ae0c2608081bcc67e80aa59d28a44e0
  SHA1: 3086ab5e43362971b3756b3bc1b1e01775185a98
	604	 	14240
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\BlackberryStorm2.xml
	604	 	9183
File
Close

C:\ProgramData\System32\xfs
  MD5:  0457eca8e7be4e0a3f26b1e4906d8747
  SHA1: a1eeaec2617649f5997672f02fb00c3f7cceb9a0
	604	 	14428
File
Hide

C:\ProgramData\System32\xfs
  MD5:  0457eca8e7be4e0a3f26b1e4906d8747
  SHA1: a1eeaec2617649f5997672f02fb00c3f7cceb9a0
	604	 	14428
File
Close

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\BlackberryStorm2.xml
  MD5:  13b983e62b2147f0a5f8587ba614bcd4
  SHA1: 63f2b53417f9ee19532a93e6889e07135c29793b
	604	 	9567
File
Open

C:\ProgramData\RealNetworks\RealDownloader\DeviceProfiles\BlackberryStorm2.xml
  MD5:  13b983e62b2147f0a5f8587ba614bcd4
  SHA1: 63f2b53417f9ee19532a93e6889e07135c29793b
	604	 	9567
2285 Repeated items skipped
File
Rename

Old Name:   C:\Users\Administrator\AppData\Local\Google\Chrome\Application\40.0.2214.115\PepperFlash\manifest.js
   on
New Name:   C:\Users\Administrator\AppData\Local\Google\Chrome\Application\40.0.2214.115\PepperFlash\EZxDgVm0bEh
   tthCUAB74zg4uD7vkIIb7aPsz3UhEAi4=.7A2F0ADB1B90B147DABB.no_more_ransom
  Imagepath:  C:\Users\Administrator\AppData\Local\Temp\factura.exe
	604	 	2432
File
Hide

C:\ProgramData\System32\xfs
  MD5:  e5166eaac2bea37aff3e7b958b76dbb6
  SHA1: 587268fbe33d8c9284aebf4f31c9b0ac68a8df16
	604	 	212178
Appexception

  Exception  Faulting  Address:  0x246b1289   Exception  Code:  0xc0000005   Exception  Level:  SECOND_CHANCE
  Exception  Type:  STATUS_ACCESS_VIOLATION   Instruction  Address:  0x000007fefc14ac25
  Description:  N/A   Imagepath:  C:\Windows\explorer.exe

  Call Stack:
 Frame No.	 Instruction Addr. 	 Module Name	 Symbol Name	 SD
	1676
Malicious  Alert
Application  Crash  Activity

Message:   Application crash detected

Malicious  Alert
Misc  Anom

Message:   Suspicious Persistence Behavior

Malicious  Alert
Misc  Anom

Message:   System file created, modified, or overwritten

OS Change Detail   (version: 1.2767)     | Items: 602  | OS Info: Microsoft WindowsXP 32-bit 5.1 sp3 16.0901   Top
Type	Mode/Class	Details (Path/Message/Protocol/Hostname/Qtype/ListenPort etc.)	Process ID	Parent ID	File Size
Analysis
Malware


Application


3 Repeated items skipped
Config  Update


Process
Started

C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  Parentname:  C:\WINDOWS\explorer.exe
  Command Line:  "C:\DOCUME~1\admin\LOCALS~1\Temp\factura.exe"
  MD5:  9995a1c9ecf2a84bb9da752dfc43cbe8
  SHA1: d54dcd18d30fc944347b994376282c9ec1b7467d
	3728	648	1206863
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\LPK.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\USP10.dll
	3728
QuerySystemTime

  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\kyEFJiaNlv
	3728
2 Repeated items skipped
File
Failed

C:\WINDOWS\system32\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\system\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\system32\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\system32\wbem\kyEFJiaNlv
	3728
File
Failed

C:\Program Files\Skype\Phone\kyEFJiaNlv
	3728
File
Failed

C:\Program Files\QuickTime\QTSystem\kyEFJiaNlv
	3728
File
Failed

C:\WINDOWS\system32\WindowsPowerShell\v1.0\kyEFJiaNlv
	3728
File
Failed

C:\Program Files\Debugging Tools for Windows (x86)\kyEFJiaNlv
	3728
API Call

  API Name:  GetDesktopWindow   Address:  0x004010e0
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  user32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\rxVwYjlhVy
	3728
2 Repeated items skipped
File
Failed

C:\WINDOWS\system32\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\system\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\system32\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\system32\wbem\rxVwYjlhVy
	3728
File
Failed

C:\Program Files\Skype\Phone\rxVwYjlhVy
	3728
File
Failed

C:\Program Files\QuickTime\QTSystem\rxVwYjlhVy
	3728
File
Failed

C:\WINDOWS\system32\WindowsPowerShell\v1.0\rxVwYjlhVy
	3728
File
Failed

C:\Program Files\Debugging Tools for Windows (x86)\rxVwYjlhVy
	3728
API Call

  API Name:  GetSystemDirectoryA   Address:  0x77121df1
  Params:  [0x771a1290, 260]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WS2_32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WS2HELP.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\netapi32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\"Common AppData"
   = C:\Documents and Settings\All Users\Application Data
	3728
Regkey
Added

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\User Shell Folders
	3728
Regkey
Added

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\Shell Folders
	3728
Regkey
Setval

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\Shell Folders\"AppData" = C:\Documents and Settings\admin\Application Data
	3728
API Call

  API Name:  GetComputerNameW   Address:  0x00413a3c
  Params:  [0x12fb4c, 0x12fb8c]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	3728
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413bac
  Params:  [0x12f984, 260]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xi" = 4F3773E1C2AF79622E62
	3728
File
Failed

C:\Documents and Settings\All Users\Application Data\SYSTEM32\XVERSION
	3728
File
Failed

C:\Documents and Settings\admin\Application Data\SYSTEM32\XVERSION
	3728
File
Failed

C:\Documents and Settings\All Users\Application Data\Windows
	3728
Folder
Created

C:\Documents and Settings\All Users\Application Data\Windows
	3728
Folder
Created

C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897
	3728
Folder
Hide

C:\Documents and Settings\All Users\Application Data\Windows
	3728
File
Failed

C:\Documents and Settings\All Users\Application Data\Windows\csrss.exe
	3728
File
Created

C:\Documents and Settings\All Users\Application Data\Windows\csrss.exe
	3728
Malicious  Alert
Malicious  Directory

Message:   Executable file created in suspicious location

Malicious  Alert
Misc  Anom

Message:   Generic Trojan Behavior

API Call

  API Name:  SetProcessDEPPolicy   Address:  0x00470bd9
  Params:  [1]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  CryptAcquireContextW   Address:  0x004247f1
  Params:  [NULL, NULL, 1, 4026531840]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  advapi32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\rsaenh.dll
	3728
2 Repeated items skipped
File
Close

C:\Documents and Settings\All Users\Application Data\Windows\csrss.exe
  MD5:  9995a1c9ecf2a84bb9da752dfc43cbe8
  SHA1: d54dcd18d30fc944347b994376282c9ec1b7467d
	3728	 	1206863
Regkey
Added

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersio
   n\Run\
	3728
Regkey
Setval

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Run\"Client Server Runtime Subsystem" = "C:\Documents and Settings\All Users\Application Data\W
   indows\csrss.exe"
	3728
Malicious  Alert
Suspicious  Persistance  Activity

Message:   Startup services added for file in suspicious folder

Malicious  Alert
Misc  Anom

Message:   Suspicious Persistence Activity

Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xVersion" = 4.0.0.1
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\rsaenh.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\crypt32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  CryptAcquireContextW   Address:  0x00424844
  Params:  [NULL, Intel Hardware Cryptographic Service Provider, 22, 0]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  advapi32.dll
	3728
API Call

  API Name:  GetDesktopWindow   Address:  0x0041e281
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  user32.dll
	3728
API Call

  API Name:  Process32First   Address:  0x00424bf3
  Params:  [0x84, 0xf3f7d0]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Malicious  Alert
Generic  Anomalous  Activity

Message:   Enumerating running processes

API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  CryptAcquireContextA   Address:  0x0050087e
  Params:  [NULL, NULL, 1, 4026531840]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  advapi32.dll
	3728
API Call

  API Name:  CryptAcquireContextW   Address:  0x004247f1
  Params:  [NULL, NULL, 1, 4026531840]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  advapi32.dll
	3728
API Call

  API Name:  CryptAcquireContextW   Address:  0x00424844
  Params:  [NULL, Intel Hardware Cryptographic Service Provider, 22, 0]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  advapi32.dll
	3728
API Call

  API Name:  GetDesktopWindow   Address:  0x0041e281
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  user32.dll
	3728
API Call

  API Name:  Process32First   Address:  0x00424bf3
  Params:  [0x98, 0xf3f748]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryA   Address:  0x74723c7f
  Params:  [0xf3e6ac, 261]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryA   Address:  0x74723c7f
  Params:  [0xf3e6b4, 261]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryA   Address:  0x74723c7f
  Params:  [0xf3e600, 261]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  SetWindowsHookExA   Address:  0x7473097c
  Params:  [2, 0x747307c3, 0x74720000, 3740]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  user32.dll
	3728
API Call

  API Name:  SetWindowsHookExA   Address:  0x7473099a
  Params:  [7, 0x747304cd, 0x74720000, 3740]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  user32.dll
	3728
Mutex

\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-1409082233-688789844-725345543-1003
	3728
Mutex

\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-1409082233-688789844-725345543-1003
	3728
Mutex

\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-1409082233-688789844-725345543-1003
	3728
Mutex

\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-1409082233-688789844-725345543-1003
	3728
Mutex

\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-1409082233-688789844-725345543-1003
	3728
Mutex

\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1409082233-688789844-725345543-1003MUTEX.Defau
   ltS-1-5-21-1409082233-688789844-725345543-1003
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\SETUPAPI.dll
	3728
API Call

  API Name:  GetSystemDirectoryW   Address:  0x77927324
  Params:  [0xf3e914, 260]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetComputerNameExW   Address:  0x77927048
  Params:  [0, 0xf3e948, 0xf3e944]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetComputerNameExW   Address:  0x779270ab
  Params:  [3, 0xf3e948, 0xf3e944]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Queryvalue

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\"ComputerName"
	3728
API Call

  API Name:  GetVolumeNameForVolumeMountPointW   Address:  0x7ca3f17e
  Params:  [NULL, \\?\Volume{e319f02c-31a9-11e1-9a3f-806d6172696f}\]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetVolumeNameForVolumeMountPointW   Address:  0x7ca3f17e
  Params:  [NULL, \\?\Volume{e319f02e-31a9-11e1-9a3f-806d6172696f}\]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Setval

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\MountPoints2\{e319f02e-31a9-11e1-9a3f-806d6172696f}\"BaseClass" = Drive
	3728
Regkey
Setval

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\MountPoints2\{e319f02c-31a9-11e1-9a3f-806d6172696f}\"BaseClass" = Drive
	3728
File
Failed

C:\Documents and Settings\admin\Application Data\tor
	3728
4 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
12 Repeated items skipped
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\hnetcfg.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Params:  [100]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Network
Listen

  Protocol  Type:  tcp   Listen  Port:  1064   IP Address:  127.0.0.1:1064
  Imagepath:  c:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
Malicious  Alert
Network  Activity

Message:   TCP listen port opened

API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Network
Connect

  Protocol  Type:  tcp   Destination  Port:  1064   IP Address:  127.0.0.1
  Imagepath:  c:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
Malicious  Alert
Network  Activity

Message:   Network outbound communication attempted

Network
Listen

  Protocol  Type:  tcp   Listen  Port:  56217   IP Address:  127.0.0.1:56217
  Imagepath:  c:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
File
Created

C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897\lock
	3728
File
Created

C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897\state.tmp
	3728
File
Close

C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897\state.tmp
  MD5:  b3e3e0dc8df66c9af4da25f37df632f0
  SHA1: 1b8d598b4efe61cbc429502392514955c5d31eab
	3728	 	199
File
Rename

Old Name:   C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897\state.tmp
New Name:   C:\Documents and Settings\admin\Local Settings\Temp\6893A5D897\state
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  b3e3e0dc8df66c9af4da25f37df632f0
  SHA1: 1b8d598b4efe61cbc429502392514955c5d31eab
	3728	 	199
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\router-stability
	3728
File
Failed

C:\Documents and Settings\admin\Application Data\TOR\GEOIP
	3728
File
Failed

C:\Documents and Settings\admin\Application Data\TOR\GEOIP6
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-certs
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-consensus
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\unverified-consensus
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-microdesc-consensus
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\unverified-microdesc-consensus
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-microdescs
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-microdescs.new
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-descriptors
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\6893A5~1\cached-extrainfo
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryA   Address:  0x004f8683
  Params:  [0xf3f924, 260]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\netman.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\MPRAPI.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\ACTIVEDS.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\adsldpc.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\ATL.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\rtutils.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\SAMLIB.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\netshell.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\credui.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\dot3api.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\dot3dlg.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\OneX.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WTSAPI32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WINSTA.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\CRYPT32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\MSASN1.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\eappcfg.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\MSVCP60.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\eappprxy.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\RASAPI32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\rasman.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\TAPI32.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WINMM.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WZCSAPI.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WZCSvc.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\WMI.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\DHCPCSVC.DLL
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\DNSAPI.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\EapolQec.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\QUtil.dll
	3728
File
Failed

C:\DOCUME~1\admin\LOCALS~1\Temp\ESENT.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\"LogSession
   Name" = stdout
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\"Active" =
   0x00000001
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\"ControlFla
   gs" = 0x00000001
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdenti
   fier
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdenti
   fier\"Guid" = 5f31090b-d990-4e91-b16d-46121d0255aa
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdenti
   fier\"BitNames" = Error Unusual Info Debug
	3728
Process
Duplicate  Opened

Source:   C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
Target:   C:\Documents and Settings\admin\Local Settings\Temp\factura.exe

3728
3728
3728
3728

Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\"LogSessio
   nName" = stdout
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\"Active" =
    0x00000001
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\"ControlFl
   ags" = 0x00000001
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdent
   ifier\"Guid" = 5f31090b-d990-4e91-b16d-46121d0255aa
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdent
   ifier\"BitNames" = Error Unusual Info Debug
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemTime   Address:  0x63004857
  Params:  [0xf3e9c8]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  SystemTimeToFileTime   Address:  0x63004862
  Params:  [0xf3e9c8, 0x630b19f8]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersio
   n\Internet Settings
	3728
Regkey
Added

\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
	3728
Regkey
Added

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\"LogSessionNa
   me" = stdout
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\"Active" = 0x
   00000001
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\"ControlFlags
   " = 0x00000001
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifi
   er
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifi
   er\"Guid" = 8aefce96-4618-42ff-a057-3536aa78233e
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifi
   er\"BitNames" = Error Unusual Info Debug
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\factura
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\factura\DEBUG
	3728
Regkey
Deleteval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\factura\DEBUG\"Trace Level"
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\factura\DEBUG\"Trace Level" =
	3728
Regkey
Setval

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\"EventMessageFile" = C:\W
   INDOWS\system32\ESENT.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\"CategoryMessageFile" = C
   :\WINDOWS\system32\ESENT.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\"CategoryCount" = 0x00000
   010
	3728
Regkey
Setval

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\"TypesSupported" = 0x0000
   0007
	3728
Wmiquery

  Imagepath:  C:\WINDOWS\system32\wbem\wmiprvse.exe
	3528
API Call

  API Name:  GetSystemDirectoryA   Address:  0x004f8683
  Params:  [0xf3f924, 260]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Network
Connect

  Protocol  Type:  tcp   Destination  Port:  9101   IP Address:  128.31.0.39
  Imagepath:  c:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
ProcessTelemetryReport

  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
10 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
4 Repeated items skipped
Malicious  Alert
High Repeated Sleep Calls

Message:   High repeated sleep calls

API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
4 Repeated items skipped
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xmode" = 751
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xpk" = -----BEGIN PUBLIC KEY-----.MIIBojANBgkqhki
   G9w0BAQEFAAOCAY8AMIIBigKCAYEAzXhnkH11n+xqxQcisQj5.OefrHjVnqNj+WJAhxscQ47lIoTW8X82MNpwTr6ZWwWHTNB0
   uoppja4vH34ZPFFow.5F/vnPoHa027gaWAZg7o1CIlUeMrKQvRSDYjW8HEHpO16qfsPDWqOIUCpI/oAgpY.XC5neQgNUgQccO
   6edxoZipUSlLZ5H8c+/996RNOM0NZawLBOLoWAHtSDYLVHgt2z.vsn43Z+nQbTzJtjHn9rtwv7ppecgE3JHTYQ4qI3T0CtF6S
   sO82mDqk7UPG3kqMb2.O13/g2G7u6vCtB951pbvG9A6z//zD2zwhufn6o8LRURvOUdRQaQGIxgCWD8KsLLS.fiXIBiemeVuHb
   OzK6cgaBR8K0Lcy1nnXo4gNZdDSRkFDcVAh4bSl8GztPYUSvFMG.5m8weQyyuABQ30O/AKtCHZlJPF0Ouy
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xstate" = 3
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"shst" = 2
	3728
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x12f200, 1024]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
8 Repeated items skipped
File
Created

C:\README1.txt
	3728
File
Close

C:\README1.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
3 Repeated items skipped
File
Created

C:\README2.txt
	3728
File
Close

C:\README2.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
File
Created

C:\README3.txt
	3728
File
Close

C:\README3.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Created

C:\README4.txt
	3728
File
Close

C:\README4.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
File
Created

C:\README5.txt
	3728
File
Close

C:\README5.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Created

C:\README6.txt
	3728
File
Close

C:\README6.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Created

C:\README7.txt
	3728
File
Close

C:\README7.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
File
Created

C:\README8.txt
	3728
File
Close

C:\README8.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Created

C:\README9.txt
	3728
File
Close

C:\README9.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
File
Created

C:\README10.txt
	3728
File
Close

C:\README10.txt
  MD5:  0723ecdfbdfd4e83bba7f77a14756784
  SHA1: d1933d895316c42bf6aca612ec9e8c45ff0d0d1e
	3728	 	2136
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xstate" = 4
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
	3728
Regkey
Added

\REGISTRY\USER\S-1-5-21-1409082233-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersio
   n\Explorer\User Shell Folders
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x12ef40, 1024]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
API Call

  API Name:  GetSystemDirectoryW   Address:  0x00413079
  Params:  [0x20ef570, 1024]
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Find

C:\*
	3728
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
7 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
23 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
11 Repeated items skipped
File
Failed

C:\System Volume Information
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
65 Repeated items skipped
File
Find

C:\MSOCache\*
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
23 Repeated items skipped
File
Find

C:\MSOCache\*\*
	3728
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
81 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	9952
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
13 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  9e188ff151ebb7c60f0d18c1e5f1400d
  SHA1: 3692667bfdeb85ead1958b5392498768172773c0
	3728	 	10336
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
3 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  9e188ff151ebb7c60f0d18c1e5f1400d
  SHA1: 3692667bfdeb85ead1958b5392498768172773c0
	3728	 	10336
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  526d94208b86b05e22bce4cd6962ba33
  SHA1: 483427412bf5a08c91e450745d8e03a413cfb214
	3728	 	10336
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
35 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\WeBlMTjJcwcvUDmf4eL5SL7kg+7nPVmiJog5J
   37q6vg=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  526d94208b86b05e22bce4cd6962ba33
  SHA1: 483427412bf5a08c91e450745d8e03a413cfb214
	3728	 	10336
Regkey
Added

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 0
	3728
12 Repeated items skipped
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 1
	3728
File
Failed

C:\Documents and Settings\All Users\Application Data\System32
	3728
Folder
Created

C:\Documents and Settings\All Users\Application Data\System32
	3728
Folder
Hide

C:\Documents and Settings\All Users\Application Data\System32
	3728
File
Failed

C:\Documents and Settings\All Users\Application Data\System32\xfs
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\setup.chm
	3728	 	52984
File
Created

C:\Documents and Settings\All Users\Application Data\System32\xfs
	3728
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  39d6b4bdcfe73f17b9647dccb3861a23
  SHA1: 72dbf1c9f3865e02a1de5729ab99335aac74c190
	3728	 	180
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  39d6b4bdcfe73f17b9647dccb3861a23
  SHA1: 72dbf1c9f3865e02a1de5729ab99335aac74c190
	3728	 	180
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 1
	3728
2 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\setup.chm
  MD5:  5f3c50cf290ff62bdb66df5c89c0c18d
  SHA1: 11a0f6e7fff411f122496f15131f568c68ba708e
	3728	 	53368
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 1
	3728
4 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\setup.chm
  MD5:  5f3c50cf290ff62bdb66df5c89c0c18d
  SHA1: 11a0f6e7fff411f122496f15131f568c68ba708e
	3728	 	53368
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\setup.chm
  MD5:  5bdd0fcc46d6876979a94c62b6984d64
  SHA1: 254eb3d2842f8f54d092eee34a695f0f05991815
	3728	 	53376
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 1
	3728
5 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 1
	3728
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\setup.chm
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\nNw-Xv39McNTXd2F5L-HbUFAg2vFYTJDS+mgG
   77zIuo=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  5bdd0fcc46d6876979a94c62b6984d64
  SHA1: 254eb3d2842f8f54d092eee34a695f0f05991815
	3728	 	53376
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 2
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
	3728	 	27084
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
  MD5:  a49331f89a2bf3e827bc17611cd957bf
  SHA1: c51115ce29cff90778d52596de2da5843cb7cf5e
	3728	 	27468
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  39d6b4bdcfe73f17b9647dccb3861a23
  SHA1: 72dbf1c9f3865e02a1de5729ab99335aac74c190
	3728	 	180
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  49bec89058fd36507cb17d359fed9845
  SHA1: 40c65ebe1a8477a7624e257b2def09c37ca464ea
	3728	 	362
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
  MD5:  a49331f89a2bf3e827bc17611cd957bf
  SHA1: c51115ce29cff90778d52596de2da5843cb7cf5e
	3728	 	27468
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
  MD5:  4169825d4e126c52cc987adcc282f99c
  SHA1: 385ed662bfde2035fc1f9b3651176abf30728505
	3728	 	27472
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  49bec89058fd36507cb17d359fed9845
  SHA1: 40c65ebe1a8477a7624e257b2def09c37ca464ea
	3728	 	362
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 2
	3728
4 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\eA5Rrbs1zCmjnnhk0QYg1H353H4W3oXrwqWdW
   -dAmhI=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  4169825d4e126c52cc987adcc282f99c
  SHA1: 385ed662bfde2035fc1f9b3651176abf30728505
	3728	 	27472
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 3
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
	3728	 	821
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  49bec89058fd36507cb17d359fed9845
  SHA1: 40c65ebe1a8477a7624e257b2def09c37ca464ea
	3728	 	362
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4dd0c83846ce516c8aff8a850b94063c
  SHA1: 1d271a435269bd1fb2573c8038ce9d0d0f81667b
	3728	 	546
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
  MD5:  da67a12f5df2eb9d0812f401a25463c3
  SHA1: 600998178a96ef8704427403906f58ff77c45a4a
	3728	 	1205
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4dd0c83846ce516c8aff8a850b94063c
  SHA1: 1d271a435269bd1fb2573c8038ce9d0d0f81667b
	3728	 	546
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 3
	3728
3 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
  MD5:  da67a12f5df2eb9d0812f401a25463c3
  SHA1: 600998178a96ef8704427403906f58ff77c45a4a
	3728	 	1205
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
  MD5:  140d643b8e67c3bb53aa07fb5e066ae2
  SHA1: 6b09b2cc0fa68338211b68313f6cb3dff0b21d47
	3728	 	1216
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 3
	3728
6 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\EDtCuwa46RBI+UnHpL973M85wamzyPI9WOlBL
   1x-W-E=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  140d643b8e67c3bb53aa07fb5e066ae2
  SHA1: 6b09b2cc0fa68338211b68313f6cb3dff0b21d47
	3728	 	1216
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 4
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
	3728	 	6003
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
  MD5:  070b01fbe9f691c002dfb729c9770823
  SHA1: ba0f854e5ec4810ef4cab70365219a4449090039
	3728	 	6387
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4dd0c83846ce516c8aff8a850b94063c
  SHA1: 1d271a435269bd1fb2573c8038ce9d0d0f81667b
	3728	 	546
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  29d6881402caf7e553b5335a2d9bb161
  SHA1: a544250d8725b1263d0f11b5a5f0346b9a8035b8
	3728	 	742
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
  MD5:  070b01fbe9f691c002dfb729c9770823
  SHA1: ba0f854e5ec4810ef4cab70365219a4449090039
	3728	 	6387
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
  MD5:  5d296d937f0f4a26e3c495f758777d1a
  SHA1: 99c61a98132b64a58796dfa557105de889c06ea4
	3728	 	6400
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  29d6881402caf7e553b5335a2d9bb161
  SHA1: a544250d8725b1263d0f11b5a5f0346b9a8035b8
	3728	 	742
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 4
	3728
6 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\dAUHwYfk3SIwZYR4qhbLVjFaZB45QFe0y0+k-
   ypxh70=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  5d296d937f0f4a26e3c495f758777d1a
  SHA1: 99c61a98132b64a58796dfa557105de889c06ea4
	3728	 	6400
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 4
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\branding.xml
	3728	 	509007
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  29d6881402caf7e553b5335a2d9bb161
  SHA1: a544250d8725b1263d0f11b5a5f0346b9a8035b8
	3728	 	742
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  6d2240cf059098ee1286d2672309d5c9
  SHA1: 2f77f555976d3454946f630a8dbc952463d8bdf2
	3728	 	932
ProcessTelemetryReport

  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  6d2240cf059098ee1286d2672309d5c9
  SHA1: 2f77f555976d3454946f630a8dbc952463d8bdf2
	3728	 	932
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
28 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\branding.xml
  MD5:  5f38fbd6c81b774fed2b9e5ab9f3689f
  SHA1: c76d7ab3d0f2d9f394486d273b74ed0bc2460d61
	3728	 	509391
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
File
Open

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\branding.xml
  MD5:  5f38fbd6c81b774fed2b9e5ab9f3689f
  SHA1: c76d7ab3d0f2d9f394486d273b74ed0bc2460d61
	3728	 	509391
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
16 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\branding.xml
  MD5:  0bedb1aed513ed1625ae4728f6abeff1
  SHA1: 9b5f198b66c073b0e4ed17dd9b20ad245e700b6b
	3728	 	509392
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
3 Repeated items skipped
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 5
	3728
3 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\branding.xml
New Name:   C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\5B7s1mKwxQV6IjC0KYnS3UiJaftOwiqXuAJnU
   cHeyzM=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  0bedb1aed513ed1625ae4728f6abeff1
  SHA1: 9b5f198b66c073b0e4ed17dd9b20ad245e700b6b
	3728	 	509392
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 6
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  6d2240cf059098ee1286d2672309d5c9
  SHA1: 2f77f555976d3454946f630a8dbc952463d8bdf2
	3728	 	932
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ad51c6802f2b39833f203e535fb75491
  SHA1: 62614e7056efe54b51fb10c38cd233241b77bad1
	3728	 	1120
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ad51c6802f2b39833f203e535fb75491
  SHA1: 62614e7056efe54b51fb10c38cd233241b77bad1
	3728	 	1120
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 6
	3728
11 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
	3728	 	1459
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 6
	3728
15 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
  MD5:  e16508f02b43d4a9264a91fa5502bc1e
  SHA1: ca0e4a56740f26af33271e5a95393a388ccff756
	3728	 	1843
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 6
	3728
2 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
  MD5:  e16508f02b43d4a9264a91fa5502bc1e
  SHA1: ca0e4a56740f26af33271e5a95393a388ccff756
	3728	 	1843
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
  MD5:  7e6b76d2cde4c6fdbc5881656d544362
  SHA1: 362fdb15c92193f5d9fd42ffe44ff3672cf49151
	3728	 	1856
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 6
	3728
7 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml
New Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\K5Wai+aK3surjjzsQuxdn-hOs6US
   OFWmJ9lUpRzi+Q4=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  7e6b76d2cde4c6fdbc5881656d544362
  SHA1: 362fdb15c92193f5d9fd42ffe44ff3672cf49151
	3728	 	1856
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 7
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ad51c6802f2b39833f203e535fb75491
  SHA1: 62614e7056efe54b51fb10c38cd233241b77bad1
	3728	 	1120
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7803af02e7e1c5aadddf50a12ecbf86c
  SHA1: 1cdd3c9ba24f1791c2f77c7a1856c6fdf0032465
	3728	 	1320
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
	3728	 	1460
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7803af02e7e1c5aadddf50a12ecbf86c
  SHA1: 1cdd3c9ba24f1791c2f77c7a1856c6fdf0032465
	3728	 	1320
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 7
	3728
4 Repeated items skipped
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
  MD5:  9de64cba62c419401287f1530dae07c9
  SHA1: b17278cfcef6dfdbd5b3c08280be92c32a442ab4
	3728	 	1844
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 7
	3728
2 Repeated items skipped
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
  MD5:  9de64cba62c419401287f1530dae07c9
  SHA1: b17278cfcef6dfdbd5b3c08280be92c32a442ab4
	3728	 	1844
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
  MD5:  c34e92cfe3bda1cd927384732e5830b3
  SHA1: 5f7e129a2796604c9e9b66112b2d7c3f77ba0ef2
	3728	 	1856
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 7
	3728
7 Repeated items skipped
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml
New Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.es\hPbLH0WyPWeI7QFpiqVjivfK2svX
   dsGQjOBl1NyOhw4=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  c34e92cfe3bda1cd927384732e5830b3
  SHA1: 5f7e129a2796604c9e9b66112b2d7c3f77ba0ef2
	3728	 	1856
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7803af02e7e1c5aadddf50a12ecbf86c
  SHA1: 1cdd3c9ba24f1791c2f77c7a1856c6fdf0032465
	3728	 	1320
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  940126e4a32ba6613d92486fc48e2c65
  SHA1: 2539fe2fcf1492c57fa3ee09e9b59342120d11d4
	3728	 	1520
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  940126e4a32ba6613d92486fc48e2c65
  SHA1: 2539fe2fcf1492c57fa3ee09e9b59342120d11d4
	3728	 	1520
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
	3728	 	1350
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
  MD5:  df68c1d0d04f14d4e0c21218362f78fa
  SHA1: e69ca8f51c57ff6cefe469110b8d0b35a12f5521
	3728	 	1734
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
  MD5:  df68c1d0d04f14d4e0c21218362f78fa
  SHA1: e69ca8f51c57ff6cefe469110b8d0b35a12f5521
	3728	 	1734
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
  MD5:  b409bd7e10f3a370916eed3600bac027
  SHA1: 512e08aa891bfc4ac7b65b7cb572a52a40695f8c
	3728	 	1744
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml
New Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proof.en\UEUCF5aYo80+42hgcshX9r1PWTJh
   -42KDE6GCGI0VqY=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  b409bd7e10f3a370916eed3600bac027
  SHA1: 512e08aa891bfc4ac7b65b7cb572a52a40695f8c
	3728	 	1744
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	5884
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  940126e4a32ba6613d92486fc48e2c65
  SHA1: 2539fe2fcf1492c57fa3ee09e9b59342120d11d4
	3728	 	1520
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  1f5e8f24654b230fd5018091adf26c21
  SHA1: a9b4a3e7301660453ed15670c2aaa548817ee0fd
	3728	 	1720
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  6eee90ce2e4083c55dc6cd9f7fc08d0c
  SHA1: 3e0d027d2861b6569fc0d6c5e4f197997a7f8819
	3728	 	6268
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  1f5e8f24654b230fd5018091adf26c21
  SHA1: a9b4a3e7301660453ed15670c2aaa548817ee0fd
	3728	 	1720
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  6eee90ce2e4083c55dc6cd9f7fc08d0c
  SHA1: 3e0d027d2861b6569fc0d6c5e4f197997a7f8819
	3728	 	6268
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  dc2345e8176d8a8a14de418af4cbeb91
  SHA1: fb962432bcc57c2388842a2878e922f3245e7c3d
	3728	 	6272
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\2jFEZub-kNhUofdW7aQMZnPaeycuIwBxMkdp1
   I21TcQ=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  dc2345e8176d8a8a14de418af4cbeb91
  SHA1: fb962432bcc57c2388842a2878e922f3245e7c3d
	3728	 	6272
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
	3728	 	813
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  1f5e8f24654b230fd5018091adf26c21
  SHA1: a9b4a3e7301660453ed15670c2aaa548817ee0fd
	3728	 	1720
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  c25de7981dc4c990696ab51451fbf8fb
  SHA1: 525b9082b94f67a7d7e297b7271928469d74566b
	3728	 	1902
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
  MD5:  35b1d92672df1220ae323bd888669d6d
  SHA1: 285ba81b0f6fb9b30627759ed40219eee40a3ae9
	3728	 	1197
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  c25de7981dc4c990696ab51451fbf8fb
  SHA1: 525b9082b94f67a7d7e297b7271928469d74566b
	3728	 	1902
File
Open

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
  MD5:  35b1d92672df1220ae323bd888669d6d
  SHA1: 285ba81b0f6fb9b30627759ed40219eee40a3ae9
	3728	 	1197
File
Close

C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
  MD5:  ee662580ebe0ac58488d8744ae996654
  SHA1: a0bee3175249b78beabe24c019d3e1ca61c6a194
	3728	 	1200
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml
New Name:   C:\MSOCache\All Users\{90120000-002C-0409-0000-0000000FF1CE}-C\+tmqgjz--OX8VY8O93nQfZ7llvlWOULdWsu9q
   tMFeAs=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  ee662580ebe0ac58488d8744ae996654
  SHA1: a0bee3175249b78beabe24c019d3e1ca61c6a194
	3728	 	1200
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  c25de7981dc4c990696ab51451fbf8fb
  SHA1: 525b9082b94f67a7d7e297b7271928469d74566b
	3728	 	1902
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ed13264cda60f8409a0e3979451bfd79
  SHA1: 4afc9bdff1595151802cd32ad3ff2303382e088f
	3728	 	2090
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ed13264cda60f8409a0e3979451bfd79
  SHA1: 4afc9bdff1595151802cd32ad3ff2303382e088f
	3728	 	2090
File
Open

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
	3728	 	1798
File
Close

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
  MD5:  ceac06b41fa39625c54f46de384d8de7
  SHA1: 867fc866ef7224620fb45e0279052f446d03c9cc
	3728	 	2182
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Open

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
  MD5:  ceac06b41fa39625c54f46de384d8de7
  SHA1: 867fc866ef7224620fb45e0279052f446d03c9cc
	3728	 	2182
File
Close

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
  MD5:  108f8cbcba74b1868e18dcf8313e0ae7
  SHA1: 3b63574a1241b451e745c6dfda08ef5330068ec8
	3728	 	2192
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\NPDRxRGfuWLc4YyCttqjRu7c37RG7moH+Uz2B
   BPL3o4=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  108f8cbcba74b1868e18dcf8313e0ae7
  SHA1: 3b63574a1241b451e745c6dfda08ef5330068ec8
	3728	 	2192
File
Open

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	2678
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  ed13264cda60f8409a0e3979451bfd79
  SHA1: 4afc9bdff1595151802cd32ad3ff2303382e088f
	3728	 	2090
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  42f50ecb88c87b557cb7030c8617742e
  SHA1: ce7f0f71b96e929b8fae83c76cbea984b92bac02
	3728	 	2276
File
Close

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  81850f130be03bb5d96652612e27bd19
  SHA1: bfd68b4d70791257a31b2b43ce6c0845d2b20ae7
	3728	 	3062
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  42f50ecb88c87b557cb7030c8617742e
  SHA1: ce7f0f71b96e929b8fae83c76cbea984b92bac02
	3728	 	2276
File
Open

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  81850f130be03bb5d96652612e27bd19
  SHA1: bfd68b4d70791257a31b2b43ce6c0845d2b20ae7
	3728	 	3062
File
Close

C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  100276c983466d50393631f5d524dc8f
  SHA1: 162b0c03a3530cad36ebb78fdacbfa69fd6da299
	3728	 	3072
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-001B-0409-0000-0000000FF1CE}-C\V6-v4fjcJiMhVgbT5pXf4cGo8VeeFihQWlRrc
   df3Ym0=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  100276c983466d50393631f5d524dc8f
  SHA1: 162b0c03a3530cad36ebb78fdacbfa69fd6da299
	3728	 	3072
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  42f50ecb88c87b557cb7030c8617742e
  SHA1: ce7f0f71b96e929b8fae83c76cbea984b92bac02
	3728	 	2276
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  0e1be55567ced43ce4300e528343122d
  SHA1: 336e6a8baab9a77f989576a49211b8815c953179
	3728	 	2458
File
Open

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	3861
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  0e1be55567ced43ce4300e528343122d
  SHA1: 336e6a8baab9a77f989576a49211b8815c953179
	3728	 	2458
File
Close

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  a0ac55d038533309ff1c05457377edf4
  SHA1: 33280b32277cb2d7331aefaeae88bf0e38ce500f
	3728	 	4245
File
Open

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  a0ac55d038533309ff1c05457377edf4
  SHA1: 33280b32277cb2d7331aefaeae88bf0e38ce500f
	3728	 	4245
File
Close

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  9a8fe5019cc6a4ea5bf18ddeff42e562
  SHA1: f4f8a75364e4b925ec6d8c5704632c230f1c23f6
	3728	 	4256
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\ofjhwmbngehiwyu2Z+NKLAEJCTWJnPyGGqCuw
   3wA5e8=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  9a8fe5019cc6a4ea5bf18ddeff42e562
  SHA1: f4f8a75364e4b925ec6d8c5704632c230f1c23f6
	3728	 	4256
File
Open

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
	3728	 	2945
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  0e1be55567ced43ce4300e528343122d
  SHA1: 336e6a8baab9a77f989576a49211b8815c953179
	3728	 	2458
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7b3e4ae96366e55872aaf0ce3add12e8
  SHA1: d249b66143545c76193f66bd308dcb8d50160a01
	3728	 	2640
File
Close

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
  MD5:  64e040e7e94342b63bb1d26f4b39f77a
  SHA1: 4700f9045c60913f6688be89704c96d91cca55f5
	3728	 	3329
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7b3e4ae96366e55872aaf0ce3add12e8
  SHA1: d249b66143545c76193f66bd308dcb8d50160a01
	3728	 	2640
File
Open

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
  MD5:  64e040e7e94342b63bb1d26f4b39f77a
  SHA1: 4700f9045c60913f6688be89704c96d91cca55f5
	3728	 	3329
File
Close

C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
  MD5:  4c34fd9e85ee5b2cee87c6cc5b7fa5ff
  SHA1: 314b26c29d4f2c0025b7841d81fee895973ccce3
	3728	 	3344
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-001A-0409-0000-0000000FF1CE}-C\Zwet1MKSSC47QoUNmFF3SErMLNE+SokPcXP-R
   nIjmL0=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  4c34fd9e85ee5b2cee87c6cc5b7fa5ff
  SHA1: 314b26c29d4f2c0025b7841d81fee895973ccce3
	3728	 	3344
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  7b3e4ae96366e55872aaf0ce3add12e8
  SHA1: d249b66143545c76193f66bd308dcb8d50160a01
	3728	 	2640
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  cdd2c2ab1528225f5eb66ab15217b51c
  SHA1: 1141bea48b82dd4205d251987e21c29f50fdcf85
	3728	 	2832
File
Open

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	2004
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  cdd2c2ab1528225f5eb66ab15217b51c
  SHA1: 1141bea48b82dd4205d251987e21c29f50fdcf85
	3728	 	2832
File
Close

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  98af4f37f73842461caa94064efa16d5
  SHA1: 5bbe777e79f8b25add9393e0148b9253ce1d2478
	3728	 	2388
File
Open

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  98af4f37f73842461caa94064efa16d5
  SHA1: 5bbe777e79f8b25add9393e0148b9253ce1d2478
	3728	 	2388
File
Close

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  2a3419ead6f80ae4139ef2fdf938c80a
  SHA1: 6a329f6f08fcbd00b521b0b5003baff3c3892add
	3728	 	2400
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\bPPbLhFgRjCtT0S895Cuc+g+UZqJUJDseRGZX
   GH6Jdc=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  2a3419ead6f80ae4139ef2fdf938c80a
  SHA1: 6a329f6f08fcbd00b521b0b5003baff3c3892add
	3728	 	2400
File
Open

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
	3728	 	1553
File
Close

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
  MD5:  a599dfcba50f044bf3aa1dc96d1b4844
  SHA1: 9aa3bd6aa2346fac581c64674e0c584ff4a0fd93
	3728	 	1937
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  cdd2c2ab1528225f5eb66ab15217b51c
  SHA1: 1141bea48b82dd4205d251987e21c29f50fdcf85
	3728	 	2832
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bff3d858cabf0dc3c26a2a423f5b2c02
  SHA1: daec0afe00cea7f03c1c2a136bb4b0b4f7885dab
	3728	 	3014
File
Open

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
  MD5:  a599dfcba50f044bf3aa1dc96d1b4844
  SHA1: 9aa3bd6aa2346fac581c64674e0c584ff4a0fd93
	3728	 	1937
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bff3d858cabf0dc3c26a2a423f5b2c02
  SHA1: daec0afe00cea7f03c1c2a136bb4b0b4f7885dab
	3728	 	3014
File
Close

C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
  MD5:  9248ac29307fe8cb5cf50fa1be51ab14
  SHA1: 2cbcb9488c22e4ab0e0520956f02971412fc85b3
	3728	 	1952
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-0018-0409-0000-0000000FF1CE}-C\6rYu-ij2l9oH5dv-NeaTNJtDAkhlywM0rGFWu
   IODgbCFGFCzA2ar5Sc4gYdx6gb+.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  9248ac29307fe8cb5cf50fa1be51ab14
  SHA1: 2cbcb9488c22e4ab0e0520956f02971412fc85b3
	3728	 	1952
File
Open

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	2527
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bff3d858cabf0dc3c26a2a423f5b2c02
  SHA1: daec0afe00cea7f03c1c2a136bb4b0b4f7885dab
	3728	 	3014
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4e70f78399bd8e53dac1db7ec3f4ddfe
  SHA1: 4aaf0335ea79a0d3f2533a17ee2d4d65d2b2e3e8
	3728	 	3212
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4e70f78399bd8e53dac1db7ec3f4ddfe
  SHA1: 4aaf0335ea79a0d3f2533a17ee2d4d65d2b2e3e8
	3728	 	3212
File
Close

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  6e3e8bbd84a897b0c17058c314c3083e
  SHA1: fe6a6b1d8647367ac649eb0e694ff53f570b0297
	3728	 	2911
File
Open

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  6e3e8bbd84a897b0c17058c314c3083e
  SHA1: fe6a6b1d8647367ac649eb0e694ff53f570b0297
	3728	 	2911
File
Close

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  64d901602242327f67f0a04169a4866f
  SHA1: e591551448800c495f404bf88d6d1f975cdbcc2c
	3728	 	2912
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\yc8YQ728mR64G7aTrQgwC0QoDFIwAOWsSLeT-
   qgsBzk=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  64d901602242327f67f0a04169a4866f
  SHA1: e591551448800c495f404bf88d6d1f975cdbcc2c
	3728	 	2912
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Open

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
	3728	 	1801
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  4e70f78399bd8e53dac1db7ec3f4ddfe
  SHA1: 4aaf0335ea79a0d3f2533a17ee2d4d65d2b2e3e8
	3728	 	3212
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  20705eec377567c6783ff1430d8422dc
  SHA1: 0a354fcf33c57c2ead76160463c437c576abdfa4
	3728	 	3394
File
Close

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
  MD5:  d00b8a4bdc248f0ef4e414d8d4479dda
  SHA1: 5f9e8e7d28151313ffdf1cad1e436b74884ee2a9
	3728	 	2185
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  20705eec377567c6783ff1430d8422dc
  SHA1: 0a354fcf33c57c2ead76160463c437c576abdfa4
	3728	 	3394
File
Open

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
  MD5:  d00b8a4bdc248f0ef4e414d8d4479dda
  SHA1: 5f9e8e7d28151313ffdf1cad1e436b74884ee2a9
	3728	 	2185
File
Close

C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
  MD5:  b80d5daeb17e75022b9f2541218100ee
  SHA1: b6e57f833a98ae85aef2158d3ffd4eacf897050c
	3728	 	2192
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-0016-0409-0000-0000000FF1CE}-C\CY6B4swVdFf3rlnS2B3k9CgHwG1OixXcDMx9K
   qZ7TjE=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  b80d5daeb17e75022b9f2541218100ee
  SHA1: b6e57f833a98ae85aef2158d3ffd4eacf897050c
	3728	 	2192
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  20705eec377567c6783ff1430d8422dc
  SHA1: 0a354fcf33c57c2ead76160463c437c576abdfa4
	3728	 	3394
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  fb496f7fde0b270bb971c4a8d14f29b0
  SHA1: 000eb70b2060cbe19f701159824ccfece189eb63
	3728	 	3582
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  fb496f7fde0b270bb971c4a8d14f29b0
  SHA1: 000eb70b2060cbe19f701159824ccfece189eb63
	3728	 	3582
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml
	3728	 	13115
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml
  MD5:  6cfc268348726af3fa1532496d3353ab
  SHA1: e07a1705d0d7faa7952e0ceffc3579f677d81135
	3728	 	13499
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml
  MD5:  6cfc268348726af3fa1532496d3353ab
  SHA1: e07a1705d0d7faa7952e0ceffc3579f677d81135
	3728	 	13499
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml
  MD5:  7609b4d2c02a6c0c6d7091141260e863
  SHA1: 30832ee4c3dd4bde917ac9ceac14e0180d00cfee
	3728	 	13504
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml
New Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\XztWhexqsqrJFo4LWhpYJNrU3fmHQE-CP1q0y
   bV17Sk=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  7609b4d2c02a6c0c6d7091141260e863
  SHA1: 30832ee4c3dd4bde917ac9ceac14e0180d00cfee
	3728	 	13504
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Setup.xml
	3728	 	24033
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  fb496f7fde0b270bb971c4a8d14f29b0
  SHA1: 000eb70b2060cbe19f701159824ccfece189eb63
	3728	 	3582
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  22af9b69d520848e1e15f1d40fb3ca2d
  SHA1: 3fdd9752b83bd89d7110169c173984062eaa4530
	3728	 	3774
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Setup.xml
  MD5:  a8e86cdbfcd7426b14b65608210b52da
  SHA1: 3c12c7c17776bac73bfbe80350e1ebd41c38bf10
	3728	 	24417
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  22af9b69d520848e1e15f1d40fb3ca2d
  SHA1: 3fdd9752b83bd89d7110169c173984062eaa4530
	3728	 	3774
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Setup.xml
  MD5:  a8e86cdbfcd7426b14b65608210b52da
  SHA1: 3c12c7c17776bac73bfbe80350e1ebd41c38bf10
	3728	 	24417
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Setup.xml
  MD5:  69a4f8bc7570fa28679151a7635693af
  SHA1: 91f2a9935d9a5e157506b6397f32096d1c4f023e
	3728	 	24432
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\FrYj+cRG8lr9AOOxNJ2ZCD9FomiKhz+CcdywA
   SwS3VU=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  69a4f8bc7570fa28679151a7635693af
  SHA1: 91f2a9935d9a5e157506b6397f32096d1c4f023e
	3728	 	24432
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml
	3728	 	2310
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  22af9b69d520848e1e15f1d40fb3ca2d
  SHA1: 3fdd9752b83bd89d7110169c173984062eaa4530
	3728	 	3774
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  66b051814baf02f3fe1107c302468386
  SHA1: dfe51efb6287ae42e9a4c48c3ccfee5d856c69d9
	3728	 	3956
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml
  MD5:  14fc3b896b237a6f4643336504b3feb8
  SHA1: 19f4a70989b22b8ac30f405a3d4466e618d2ec5f
	3728	 	2694
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  66b051814baf02f3fe1107c302468386
  SHA1: dfe51efb6287ae42e9a4c48c3ccfee5d856c69d9
	3728	 	3956
File
Open

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml
  MD5:  14fc3b896b237a6f4643336504b3feb8
  SHA1: 19f4a70989b22b8ac30f405a3d4466e618d2ec5f
	3728	 	2694
File
Close

C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml
  MD5:  1c47d1ef4e5878ba38147fb7c6f00518
  SHA1: 7f3335ccf3f7bc10f33bd901315d5c316a8491ad
	3728	 	2704
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml
New Name:   C:\MSOCache\All Users\{90120000-0012-0000-0000-0000000FF1CE}-C\wG-GugL23H5H0mLOJZoedkauUAUKwv4PmAwhw
   RSCH2E=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  1c47d1ef4e5878ba38147fb7c6f00518
  SHA1: 7f3335ccf3f7bc10f33bd901315d5c316a8491ad
	3728	 	2704
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  66b051814baf02f3fe1107c302468386
  SHA1: dfe51efb6287ae42e9a4c48c3ccfee5d856c69d9
	3728	 	3956
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  02a3e5015b04526b2949707d9fec9600
  SHA1: 6ad22bcbd9450ddea94355eb9db2b0eb9e8b3223
	3728	 	4148
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  02a3e5015b04526b2949707d9fec9600
  SHA1: 6ad22bcbd9450ddea94355eb9db2b0eb9e8b3223
	3728	 	4148
File
Open

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\Setup.xml
	3728	 	1251
File
Close

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  04425146afa5b88969ce9d2af0b40ea0
  SHA1: d50a3cfd37df87cbdc6e5277ce5172d1769dc2aa
	3728	 	1635
File
Open

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  04425146afa5b88969ce9d2af0b40ea0
  SHA1: d50a3cfd37df87cbdc6e5277ce5172d1769dc2aa
	3728	 	1635
File
Close

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\Setup.xml
  MD5:  36f028e51b43ffde6d5ebb907ade6a9a
  SHA1: 70ad07e12a7db1597a41dacef0aa7d6dde9fbed4
	3728	 	1648
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\Setup.xml
New Name:   C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\xd6VBgZxiTY-zi8HmV-Q3zIgSrR-pAGi5xfTE
   5WV6ag=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  36f028e51b43ffde6d5ebb907ade6a9a
  SHA1: 70ad07e12a7db1597a41dacef0aa7d6dde9fbed4
	3728	 	1648
File
Open

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\RosebudMUI.xml
	3728	 	811
File
Close

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\RosebudMUI.xml
  MD5:  676c3ccde3811ffefa7a767b88ac7cdf
  SHA1: e40442233a3fbe117481748e84611db4aca79d9c
	3728	 	1195
File
Open

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\RosebudMUI.xml
  MD5:  676c3ccde3811ffefa7a767b88ac7cdf
  SHA1: e40442233a3fbe117481748e84611db4aca79d9c
	3728	 	1195
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  02a3e5015b04526b2949707d9fec9600
  SHA1: 6ad22bcbd9450ddea94355eb9db2b0eb9e8b3223
	3728	 	4148
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  5d94f54c8b5379921c3798fa4c946408
  SHA1: 10c2e5bf667c80de748d5b305d86edcc7c43d1f8
	3728	 	4330
File
Close

C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\RosebudMUI.xml
  MD5:  e0c3b4257b9222183a35a2fd97f3ba97
  SHA1: 54653f112c12f95a8d8c98a5ea8bb6720a802fba
	3728	 	1200
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  5d94f54c8b5379921c3798fa4c946408
  SHA1: 10c2e5bf667c80de748d5b305d86edcc7c43d1f8
	3728	 	4330
File
Rename

Old Name:   C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\RosebudMUI.xml
New Name:   C:\MSOCache\All Users\{90120000-0010-0409-0000-0000000FF1CE}-C\kLYsuU6+u2Eavb7csWANaB+1gvfw-bHy2cWlJ
   oJLMGo=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  e0c3b4257b9222183a35a2fd97f3ba97
  SHA1: 54653f112c12f95a8d8c98a5ea8bb6720a802fba
	3728	 	1200
File
Find

C:\Documents and Settings\*
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  5d94f54c8b5379921c3798fa4c946408
  SHA1: 10c2e5bf667c80de748d5b305d86edcc7c43d1f8
	3728	 	4330
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  a32308573e380f98e068df1d6d928a2d
  SHA1: 957472f55e482f6679a00919ed483d1cb932c1cc
	3728	 	4522
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  a32308573e380f98e068df1d6d928a2d
  SHA1: 957472f55e482f6679a00919ed483d1cb932c1cc
	3728	 	4522
API Call

  API Name:  Sleep   Address:  0x0040de21
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe   DLL Name:  kernel32.dll
	3728
File
Failed

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.
   dat.LOG
	3728
File
Failed

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.
   dat
	3728
Folder
Open

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials
	3728
Folder
Open

C:\Documents and Settings\NetworkService\Cookies
	3728
ProcessTelemetryReport

  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
	3728
Folder
Open

C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials
	3728
File
Failed

C:\Documents and Settings\NetworkService\ntuser.dat.LOG
	3728
File
Failed

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
	3728
File
Failed

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
	3728
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.XML
	3728	 	12784
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.XML
  MD5:  cb355036d1a682979930881289c32fe3
  SHA1: 11d85afdacb0324859b463338f01672ceada2711
	3728	 	13168
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.XML
  MD5:  cb355036d1a682979930881289c32fe3
  SHA1: 11d85afdacb0324859b463338f01672ceada2711
	3728	 	13168
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.XML
  MD5:  0d1ed8a1fa5559ddd57be59ece651126
  SHA1: 0744fc825b402adc87b4adca04a360321d7a3aed
	3728	 	13168
File
Rename

Old Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.XML
New Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\c
   Q7Cpemiy8aZPUh-Ujh1EAZSBuYE2UgN4a3QITfhXfQ=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  0d1ed8a1fa5559ddd57be59ece651126
  SHA1: 0744fc825b402adc87b4adca04a360321d7a3aed
	3728	 	13168
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.DTD
	3728	 	498
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.DTD
  MD5:  958839c0199cb4cdc04f8cbdb2657605
  SHA1: d37ea728584d85e6a13472c0e9aed63e05548c6e
	3728	 	882
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  a32308573e380f98e068df1d6d928a2d
  SHA1: 957472f55e482f6679a00919ed483d1cb932c1cc
	3728	 	4522
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  e1ec334809837b3ffe53ff91efa45c23
  SHA1: e87da2cc46babc65f6590875b97b5e043ca24e06
	3728	 	4780
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.DTD
  MD5:  958839c0199cb4cdc04f8cbdb2657605
  SHA1: d37ea728584d85e6a13472c0e9aed63e05548c6e
	3728	 	882
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  e1ec334809837b3ffe53ff91efa45c23
  SHA1: e87da2cc46babc65f6590875b97b5e043ca24e06
	3728	 	4780
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.DTD
  MD5:  a68a139e356e0671a99486f841f289dc
  SHA1: 71685760d6c6eea8ad2937e197365e41d3d646e1
	3728	 	896
File
Rename

Old Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   MSDKNS.DTD
New Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\W
   DyM51Atr6pWnJVnDfbYZF6fG2NjHMHbLmSD6aYTN5E=.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  a68a139e356e0671a99486f841f289dc
  SHA1: 71685760d6c6eea8ad2937e197365e41d3d646e1
	3728	 	896
File
Failed

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.da
   t.LOG
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  e1ec334809837b3ffe53ff91efa45c23
  SHA1: e87da2cc46babc65f6590875b97b5e043ca24e06
	3728	 	4780
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  46d84d1d775ad4b13914982c0628bbc4
  SHA1: 1b9484595945b7f3a621001354e776778346f0c3
	3728	 	5038
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  46d84d1d775ad4b13914982c0628bbc4
  SHA1: 1b9484595945b7f3a621001354e776778346f0c3
	3728	 	5038
File
Failed

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.da
   t
	3728
Folder
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials
	3728
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
	3728	 	114232
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
  MD5:  dc392415e495b0632a6c99950205c2d9
  SHA1: b3bf527827c9606a06af2f56bb732615c04b91b1
	3728	 	114616
File
Open

C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
  MD5:  dc392415e495b0632a6c99950205c2d9
  SHA1: b3bf527827c9606a06af2f56bb732615c04b91b1
	3728	 	114616
File
Close

C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
  MD5:  1d781aef6f642af706e1756563e751b7
  SHA1: 5110b96bfa44c818fd4bdd45bb2081f097657cba
	3728	 	114624
File
Rename

Old Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
New Name:   C:\Documents and Settings\LocalService\Local Settings\Application Data\XPDwOv-JkqLjD1tNCEddfi3yYhNYf
   52ZP9+NwdyrC7oHTprE48MoClk1r3He2iQ1.4F3773E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  1d781aef6f642af706e1756563e751b7
  SHA1: 5110b96bfa44c818fd4bdd45bb2081f097657cba
	3728	 	114624
Folder
Open

C:\Documents and Settings\LocalService\Cookies
	3728
File
Failed

C:\Documents and Settings\LocalService\Cookies\index.dat
	3728
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  46d84d1d775ad4b13914982c0628bbc4
  SHA1: 1b9484595945b7f3a621001354e776778346f0c3
	3728	 	5038
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bce51e878b486b4fe34a7a1c8cd25f63
  SHA1: 6a10783a3621faf48ffd884be9244acef668157d
	3728	 	5258
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bce51e878b486b4fe34a7a1c8cd25f63
  SHA1: 6a10783a3621faf48ffd884be9244acef668157d
	3728	 	5258
Folder
Open

C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials
	3728
File
Failed

C:\Documents and Settings\LocalService\ntuser.dat.LOG
	3728
File
Open

C:\Documents and Settings\Default User\Templates\wordpfct.wpd
	3728	 	30
File
Close

C:\Documents and Settings\Default User\Templates\wordpfct.wpd
  MD5:  05150055dfad0f74be78c4ee75ee4930
  SHA1: 571b97adaa3eeddee8b465b2642b9c6d6dcd4870
	3728	 	414
File
Open

C:\Documents and Settings\Default User\Templates\wordpfct.wpd
  MD5:  05150055dfad0f74be78c4ee75ee4930
  SHA1: 571b97adaa3eeddee8b465b2642b9c6d6dcd4870
	3728	 	414
File
Close

C:\Documents and Settings\Default User\Templates\wordpfct.wpd
  MD5:  6bd0dbdb5334d6f91c65d55969201a16
  SHA1: cf49bffed65c1e363bf3bf620c1f5114a14da915
	3728	 	416
File
Rename

Old Name:   C:\Documents and Settings\Default User\Templates\wordpfct.wpd
New Name:   C:\Documents and Settings\Default User\Templates\8rzQr4e2qQSFw8IGMa7ggqwrM0a8mQ7PflQadi4lYVU=.4F3773
   E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  6bd0dbdb5334d6f91c65d55969201a16
  SHA1: cf49bffed65c1e363bf3bf620c1f5114a14da915
	3728	 	416
File
Open

C:\Documents and Settings\Default User\Templates\winword2.doc
	3728	 	1769
File
Close

C:\Documents and Settings\Default User\Templates\winword2.doc
  MD5:  24d9d0912623cfe1eb155bfc1bb2096c
  SHA1: ca0c9e56d06d745fb7e0540bdcbb358dab48d25b
	3728	 	2153
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  bce51e878b486b4fe34a7a1c8cd25f63
  SHA1: 6a10783a3621faf48ffd884be9244acef668157d
	3728	 	5258
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  d189a2def54d1356d97f573457d73aa4
  SHA1: 960ec9e071ce70826c7c2df1f58454312253ef73
	3728	 	5418
File
Open

C:\Documents and Settings\Default User\Templates\winword2.doc
  MD5:  24d9d0912623cfe1eb155bfc1bb2096c
  SHA1: ca0c9e56d06d745fb7e0540bdcbb358dab48d25b
	3728	 	2153
File
Close

C:\Documents and Settings\Default User\Templates\winword2.doc
  MD5:  79444022092aac843f1f49ebbb35c43f
  SHA1: 8185a5b6c014cf239c6c82a8dd5007d509ba7478
	3728	 	2160
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  d189a2def54d1356d97f573457d73aa4
  SHA1: 960ec9e071ce70826c7c2df1f58454312253ef73
	3728	 	5418
File
Rename

Old Name:   C:\Documents and Settings\Default User\Templates\winword2.doc
New Name:   C:\Documents and Settings\Default User\Templates\m4z6hnNG5Jzfea7EAbC+pSDSdnLGyGsT54xgmflTJrU=.4F3773
   E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  79444022092aac843f1f49ebbb35c43f
  SHA1: 8185a5b6c014cf239c6c82a8dd5007d509ba7478
	3728	 	2160
File
Open

C:\Documents and Settings\Default User\Templates\winword.doc
	3728	 	4608
File
Close

C:\Documents and Settings\Default User\Templates\winword.doc
  MD5:  b190e59303e28f295598f582b337407a
  SHA1: f0c06618c05075a7bc9f7860b17eae622a6468d9
	3728	 	4992
File
Open

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  d189a2def54d1356d97f573457d73aa4
  SHA1: 960ec9e071ce70826c7c2df1f58454312253ef73
	3728	 	5418
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  8fdc5ae8022f0184b0fe281193b2a31c
  SHA1: c78432ff05ab18a0e1c10ada1c66a5dd832335ef
	3728	 	5578
File
Open

C:\Documents and Settings\Default User\Templates\winword.doc
  MD5:  b190e59303e28f295598f582b337407a
  SHA1: f0c06618c05075a7bc9f7860b17eae622a6468d9
	3728	 	4992
File
Close

C:\Documents and Settings\Default User\Templates\winword.doc
  MD5:  27783ec3ba48bfc8b4c5c832b04d5e86
  SHA1: 7f93bc49483263eedcaf64eb9b95d12320be71c8
	3728	 	4992
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  8fdc5ae8022f0184b0fe281193b2a31c
  SHA1: c78432ff05ab18a0e1c10ada1c66a5dd832335ef
	3728	 	5578
File
Rename

Old Name:   C:\Documents and Settings\Default User\Templates\winword.doc
New Name:   C:\Documents and Settings\Default User\Templates\5I7iDxM4lfcLBdNUT9HQHtchUUXvTjrecxg7Fq3aGxM=.4F3773
   E1C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  27783ec3ba48bfc8b4c5c832b04d5e86
  SHA1: 7f93bc49483263eedcaf64eb9b95d12320be71c8
	3728	 	4992
File
Open

C:\Documents and Settings\Default User\Templates\sndrec.wav
	3728	 	58
66 Repeated items skipped
File
Close

C:\Documents and Settings\Default User\Cookies\index.dat
  MD5:  9d9974dfca47938afbe1530c9901115d
  SHA1: d25ec728e02a9a7b22b76719190f4d2b3e1bfe09
	3728	 	16768
Folder
Open

C:\Documents and Settings\Default User\Cookies
	3728
File
Rename

Old Name:   C:\Documents and Settings\Default User\Cookies\index.dat
New Name:   C:\Documents and Settings\Default User\Cookies\L9vFkdZbwYZBiCn42xwRNYmx30gqe0NXLZpl4xT5IyE=.4F3773E1
   C2AF79622E62.no_more_ransom
  Imagepath:  C:\Documents and Settings\admin\Local Settings\Temp\factura.exe
  MD5:  9d9974dfca47938afbe1530c9901115d
  SHA1: d25ec728e02a9a7b22b76719190f4d2b3e1bfe09
	3728	 	16768
34 Repeated items skipped
File
Close

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  f5da60a725287c8c41ecdf051a291833
  SHA1: 22a9766f266523818cb235a64ec4eb870b631676
	3728	 	7856
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  f5da60a725287c8c41ecdf051a291833
  SHA1: 22a9766f266523818cb235a64ec4eb870b631676
	3728	 	7856
Ransom

C:\Documents and Settings\All Users\Documents\ykQab\zvLmin.doc
MD5:  a429f7e02827c5cb4549b687d134924b

Malicious  Alert
Ransomware

Message:   Ransomware Activity

Malicious  Alert
Misc  Anom

Message:   Ransomware Activity

1307 Repeated items skipped
File
Hide

C:\Documents and Settings\All Users\Application Data\System32\xfs
  MD5:  852acadfd45e6f53dd8f79e5d685d196
  SHA1: 009eaee6437acfa9658fb95ae58269834c3d92cf
	3728	 	66036
Regkey
Setval

\REGISTRY\MACHINE\SOFTWARE\System32\Configuration\"xcnt" = 290
	3728
Malicious  Alert
Misc  Anom

Message:   System file created, modified, or overwritten

Malicious  Alert
Misc  Anom

Message:   Suspicious Persistence Behavior